When you enable 2FA for a user, the system immediately expects the user to provide a valid authentication code the next time they log in. However, since the user has not yet set up 2FA (i.e. they have not scanned the QR code or received the secret key to authenticate), they are locked out of the dashboard. The system does not allow the user to log in without entering the 2FA code, but they have not generated the code, resulting in an immediate access issue.