Feature request: Force 2fa for all users but have an option to exclude specific groups about twofactor_email HOT 1 CLOSED

I think that everything you ask for in your feature request already is available today from the basic 2FA infrastructure Nextcloud provides by the core package. This app only adds one more METHOD of 2FA (to be able to use an e-mail challenge as a second factor). The core functionality allows you to enforce ANY 2FA method – generally or for certain groups only, and allows you to exclude other groups from enforcement, see https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/two_factor-auth.html#enforcing-two-factor-authentication

Neither Nextcloud nor any Nextcloud 2FA app allows you to enforce a SPECIFIC 2FA method (such as twofactor_email), or to exclude a 2FA METHOD from enforcement. I will also not implement it since I think that the core functionality is suitable for all use cases I am aware of including yours. Some Nextcloud 2FA apps (inluding twofactor_email) currently lack support for INITIAL 2FA support. That is, to be able as a user to set up 2FA upon first logon after 2FA enforcement or user account creation. However, there already is an issue for this app, and a pull request draft that would fix it.

from twofactor_email.