When creating new users, users receive an email that prompts them to setup their password. After setting their password, they are immediately logged in. They are not required to setup 2FA until the 2nd time they sign in. If they don't log in frequently/ever, their account would exist without 2FA.