This message was deleted.

This is a good idea, but I'd be real wary about sending that to the user in a format that can be archived. If that secret is compromised then it's my understanding that an attacker can import that themselves and have a valid OTP setup. While they can certainly take a picture of the native enrollment process, this would at least require them to have the forethought to do so intentionally versus not deleting an email. Perhaps something like providing access to a Sharefile link that expires would be a happy medium.

Yep good idea on the ShareFile link with expiration.