Enroll new user in 2-Step verification through the Google API

Question

We are using Google API to create new google accounts (users and their emails).

New requirement is that we should support 2-Step authentication enabled in admin.google.com (for sub-organization) and we need to enforce the rule.

Now comes the problem: If we create new user in this sub-org it will try to enforce 2-Step authentication and, as it is not setup, user will not be able to login to set it up. And admin cannot setup 2-step verification for the user.

Even more... I need to be able to setup users 2-step verification through the API.

Does workaround for this exist, or does anyone have any idea how to do it?

Any suggestions are welcome, thanks

UPDATE 1

Thanks to Jay Lee's answer I am expanding a bit with working C# code using Google.Apis.Admin.Directory.directory_v1 SDK

    private string GenerateVerificationCode(string userKey)
    {

        var _service = new DirectoryService(new BaseClientService.Initializer()
        {
            HttpClientInitializer = credential,
            ApplicationName = _applicationName,
        });
        var generateVerificationCodesRequest = _service.VerificationCodes.Generate(userKey);
        generateVerificationCodesRequest.Execute();
        var verificationCodesRequest = _service.VerificationCodes.List(userKey);
        var verificationCodes = verificationCodesRequest.Execute();
        var verificationCode = verificationCodes.Items[0].VerificationCodeValue;
        return verificationCode;
    }

Answer 1

You can:

1. Make sure user is created in an OU where 2SV is forced. Set the orgUnitPath attribute when calling users.create()
2. Call VerificationCodes.generate() for the new user to create backup codes to get backup 2SV codes for the user.
3. Share the backup codes with the new user along with their password and instructions for first login and setup of 2SV.

User will be able to pass 2SV with the backup codes for first login. Then they can setup normal 2SV via SMS or app. You'll want to provide new users with a good set of detailed instructions for this process as it does complicate onboarding but it means they are secure on day one.