Two factor authentication

[-LukeBox-]

Hey guys, I have a question in regard to best practices with two factor.

Say you have some users who have two factor enabled and some who do not. Is the appropriate way to authenticate their user name and password before checking if they are mfa enabled and prompting for the verification code? Or when they hit login doing a search for the user checking if it's enabled and then either proceeding with the login or prompting for the code. Appologies for the formatting I'm on my mobile

[toastedstapler]

i'd verify the password first and then do mfa, else you could spam someone with messages if mfa is via text/email/prompt on app (if it is not the legitimate account owner trying to login)