Refreshing 2FA grace period for a specific user

Question

As described in the documentation, users who don't activate 2FA within a specified period of time will be locked out.

How can those users be restored to a valid state? Are administrations expected to completely disable and re-enable the 2FA if a user doesn't make the deadline?

Answer

It's possible to refresh the grace period for a specific user using the REST API:

POST /app/rest/2FA/<userLocator>/refreshGracePeriod

Additional information

REST API: Manage Two-Factor Authentication