Plan a two-factor authentication rollout and staff communication

SITE PROFILE: [WooCommerce store, 30 staff accounts across roles: 4
Administrators, 6 Shop Managers, 14 Editors/Authors on the content side, 6
Contributors who are mostly freelance writers. No 2FA currently enforced.
Application Passwords are enabled site-wide for a couple of integrations.
XML-RPC is still active because an old mobile app used it, nobody's sure if
it's still needed.]

Plan the rollout the way someone who has to actually live with the support
tickets afterward would:
1. Phase the enforcement instead of flipping it on for everyone at once: who
   goes first (Administrators and Shop Managers, since they touch orders,
   payments, and settings), who follows next, and what grace period each phase
   gets before enforcement becomes mandatory rather than optional.
2. Design the recovery path before rollout, not after the first lockout: backup
   codes, a documented process for someone who loses their phone, and who on
   staff is authorized to manually clear a user's 2FA requirement in an
   emergency without that becoming a standing backdoor.
3. Address the two bypass paths this site already has open: Application
   Passwords and XML-RPC. State whether either needs to be restricted or
   disabled as part of this rollout, since 2FA on the login form doesn't help if
   an attacker can authenticate a different way.
4. Draft the actual email or Slack message to staff: what's changing, why, exact
   enforcement date per phase, and a one-paragraph "how to set this up" that a
   non-technical Contributor could follow without a ticket to IT.
5. Flag what "done" looks like: a way to confirm every in-scope account has 2FA
   enrolled before the grace period ends, not just that the policy was announced.