Currently, we tell every new employee on joining the org to enable it, and review it a week later to ensure that they followed through. It is the exact same wi

Currently, we tell every new employee on joining the org to enable it, and review it a week later to ensure that they followed through. It is the exact same with Google Apps as well (where you add the user to the 2faexceptions group and review+remove them a week later). I was ready to flip the switch, till I realized that a third-party bot account in our organization doesn't have 2fa. Dropped them a mail, hoping to flip it by tomorrow (100% non-bot users have it enabled, so no one is getting auto-kicked).