oh yes of course they can set-up 2-factor authentication themselves, but it's not supported ''out-of-the-box'' is it?
This is what I mean: http://www.neowin.net/news/microsoft-explains-why-outlookcom...
With Google Apps you just turn it on... and can force users to use it.