Automating the MFA Device Activation for IAM Users
Solution 1:
My solution to this is a two step activation process for new users:
- Create the user with enough rights to change their password and update their MFA. Tell them they need to update their MFA. They do not get into their 'real' groups yet.
- Have a polling script that runs periodically. If a user has their MFA activated, they get added to their designated groups.
Users who don't update their MFA will be able to do... nothing. When they complain, send them the reminder of how to update their MFA. When they come back with OK, I've done it, run the #2 script.