Add Enforce 2FA documentation

Enforce 2FA is a feature for all organizations who want to
ensure that all users of their organization have 2FA enabled
before they can access their organiztion.

Enforce 2FA is part of the Q3 releas.

data/nav.yml

@@ -314,6 +314,8 @@
           path: "team-management"
         - name: "User and team permissions"
           path: "team-management/permissions"
+        - name: "Enforce 2FA"
+          path: "team-management/enforce-2fa"
     - name: "Governance"
       children:
         - name: "Overview"

pages/team_management/enforce_2fa.md

@@ -0,0 +1,28 @@
+---
+keywords: docs, tutorials, 2fa
+---
+
+# Enforce Two-factor authentication (2FA)
+
+Two-factor authentication can be enforced for the whole organization to ensure that all users who access
+the organization have Two-factor authentication enabled.
+
+## Before enforcing Two-factor authentication
+
+Before you enforce Two-factor authentication for your organization, consider
+any users without 2FA already enabled setup will immediately lose access to the
+organization and subsequent pipelines.
+
+Users can set up Two-factor authentication by following this [tutorial].
+
+## Steps to enforce Two-factor authentication
+
+To enforce Two-factor authentication:
+
+- You must be logged in as an Administrator
+- Vist the Organization's [security settings]
+- Check **Enforce Two-factor authentication**
+- Click **Update Access Control**
+
+[security settings]: <https://buildkite.com/organizations/~/security>
+[tutorial]: <../tutorials/2fa>

pages/tutorials/2fa.md

@@ -54,12 +54,8 @@ You need to ask the administrator of your Buildkite organization to remove your
 
 ## Enforcing two-factor authentication for the whole organization
 
-Currently, it's not possible to enforce 2FA in Buildkite for members of an organization. However, you can check the current 2FA status using the [User Settings](https://buildkite.com/user/settings) page for your organization. You'll see a 2FA badge next to the users who have it enabled.
-
-<%= image "2fa-8.png", width: 866, height: 222, alt: "Checking Two-Factor Authentication Status of a User" %>
-
-If conducting a regular audit is not enough, many SSO providers can enforce 2FA. In turn, Buildkite can enforce SSO for members of an organization. If you're already using an SSO provider this may be a solution. Read more about [using SSO with Buildkite](/docs/integrations/sso).
-
+Organziation administrators who would like to enforce two-factor authencation
+across their entire organization can do so following the [Enforce 2FA](../team-management/enforce-2fa) guide.
 
 [1Password]: <https://support.1password.com/one-time-passwords/>
 [OTP Auth]: <https://cooperrs.de/otpauth.html>