So there is no way to require 2FA during log in. I have to either have to enforce it on my endpoints and/or code in login UI in way that user is prompted to do second factor right after first factor?

Hello Andrey, yes you have full control over this in your application. See also this document: https://www.ory.sh/docs/kratos/guides/two-factor-authentication-2fa-mfa#requesting-second-factor-authentication Let me know if that helped.