initial mfa on additional users