Mandatory 2FA at registration vs optional enrollment: balancing compliance requirements against onboarding drop-off

Context

Laravel Jetstream exposes two-factor authentication as an optional per-user feature through Fortify's Features::twoFactorAuthentication() flag. The framework does not ship with a built-in toggle to enforce 2FA during registration, so teams must decide whether to implement mandatory enrollment via custom middleware or keep the default opt-in flow.

Constraint

A SaaS product targeting regulated industries must satisfy audit requirements that demand 2FA for all accounts, yet the same product experiences measurable sign-up abandonment when additional steps are inserted before the first dashboard view. Jetstream's recovery-code mechanism adds further operational overhead: the documentation does not clarify whether a consumed recovery code is invalidated immediately or whether a fresh set is issued automatically after partial use, complicating support run-books for locked-out users.

Decision point

Which approach better serves a compliance-driven product with limited support capacity?

1. Enforce 2FA at registration with custom middleware, accepting higher initial friction but eliminating the "unenrolled" account class entirely.
2. Keep enrollment optional, implement a grace-period nudge campaign, and invest in automated recovery-code rotation tooling to reduce manual support tickets.