Depending on logging settings, what appears in your logs varies.
It's impossible to tell whether a 2FA challenge was actually presented (unless a pass/fail happens) in WMF production.
For example on my dev wiki, we see:
2026-05-09 23:19:34 ubuntu64-web-esxi wikidb-mw_: Reedy successfully logged in using temp password 2026-05-09 23:19:34 ubuntu64-web-esxi wikidb-mw_: Primary login with MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider succeeded 2026-05-09 23:19:34 ubuntu64-web-esxi wikidb-mw_: Secondary login with MediaWiki\Extension\OATHAuth\Auth\SecondaryAuthenticationProvider returned UI 2026-05-09 23:19:46 ubuntu64-web-esxi wikidb-mw_: OATHAuth user Reedy entered a valid OTP from $IP 2026-05-09 23:19:46 ubuntu64-web-esxi wikidb-mw_: Secondary login with MediaWiki\Extension\OATHAuth\Auth\SecondaryAuthenticationProvider succeeded 2026-05-09 23:19:46 ubuntu64-web-esxi wikidb-mw_: Secondary login with MediaWiki\Extension\EmailAuth\EmailAuthSecondaryAuthenticationProvider succeeded 2026-05-09 23:19:46 ubuntu64-web-esxi wikidb-mw_: Secondary login with MediaWiki\Auth\ResetPasswordSecondaryAuthenticationProvider returned UI
But those don't appear in WMF production, as we don't track "debug" logs:
case AuthenticationResponse::PASS: $this->logger->debug( 'Secondary login with {id} succeeded', [ 'id' => $id, ] );
It would be useful if we had a OATHAuth user {username} was presented a 2FA challenge type warning when they get past the password, but are presented a form to do something.