It is really good that SOGo supports MFA. However, I think there should be an option to enforce it.
Could be forced upon first login (like a mandatory password change upon first login)

But even better: something like azure, where there is a 30-day period during which the used is asked to setup MFA, with a counter: X days left to setup MFA.

Optionally it would be nice to be able to select groups that are required to setup MFA, to roll out MFA in phases.