So after doing some research on account recovery/lost password best practices we decided to require a backup email account for password reset. That's easy enough for new users, but I'm unsure how to message our existing users. It's going to be required and can't be associated with their employer (it has to be a private account).
Do I pop up a modal requiring them to add a backup email the next time they login? Do I prevent them from moving around in the app until they do it? How do I phrase the message? Can anyone point to any accessible screenshots of someone who did it well?
As always, I really appreciate the advice.