Passive Activation of Two-Factor Authentication

I believe my team is experiencing an account authorization problem that Box is creating. My team is using Box for several clients. Until recently, none of them have required users to use two-factor authentication (2FA). When a client invites an existing Box user to a folder that DOES require 2FA, Box enables 2FA (and requires it) without the users first establishing authentication methods. This led me to a length authorization procedure where I had to prove I was a user of Box. I feel like Box is creating this problem and may not know how it’s arising.