Enable secondary authentication on SPP group


I'm using One Identity Defender to enable the 2FA in Safeguard for Privileged Password.

I enabled the secondary authentication option in the Active Directory group's authentication tab on SPP but the users are still able to login without the OTP.

If I enable the secondary authentication on the single user it works fine.

Is there a workaround to enable that for many users all at once?