MFA for first-time users

Configuring the server
1

I am asked to configure Keycloak to implement “MFA for first-time users” while using Keycloak as an authenticator.

Keycloak user reference says that I can drop “Force Multi-factor authenticator” to “Required User Action” in the user profile, but it forces MFA every time the user logs in.

Can someone advise me if I have done something wrong or there are other steps required beyond what I have done?

Thanks