...
Before an admin is allowed to configure multifactor policies, at at least one extra verification factor must be registered on their account. This restriction exists to make sure admins can themselves register successfully before making it a requirement for other users.
...
Users may either be forced to enrol a verification factor, or they may be encouraged to do so, meaning they are allowed to skip enrolment and do it at a later time. The Cannot log in is useful in cases where users are assumed to be enrolled up front, and where enrolling after this point should not be allowedor when you have another policy which allow users to enrol only from the internal network. Select Log in as usual if you don't want this policy to enforce enrolment of verification factors.
...