There is currently no mechanism to require existing users to use TFA; if you use "authenticated user" with "Roles required to have set up TFA", then new users cannot set up TFA and existing users without TFA will not be able to log in.

[![TFA rejecting newly created user][1]][1]

TFA doesn't provide any mechanism for this, so I wrote a module that provides Rules integration and created a basic rule that would do it.

https://www.drupal.org/project/tfa_rules

Instructions on setting up basic TFA on a site:

Download and install Two-Factor Authentication, TFA Basic Plugins, Rules and TFA Rules

    drush dl tfa tfa_basic rules tfa_rules

Enable.

    drush -y en tfa tfa_basic rules rules_admin tfa_rules

Configure TFA: /admin/config/people/tfa

 - [X] Enable TFA
 - Default validation plugin: TOTP
 - Roles required to have set up TFA
   - [X] authenticated user
   
Configure permissions: /admin/people/permissions

 - Set up TFA for account
  - [X] authenticated user

Visit /admin/config/workflow/rules to configure the rule.

Testing:

- Log out
- Create a user
- Login
- User will be redirected to the security page to set up TFA.

[![TFA Rules message][2]][2]


  [1]: https://i.sstatic.net/E4beP.png
  [2]: https://i.sstatic.net/dUIEu.png