I'd like to use SSO and make 2FA mandatory for my organization.

It is not possible to require 2FA when SSO is configured, but it is possible to set up both. You can see who has 2FA configured on the Members page, or you can use this API endpoint to retrieve user data for the organization that will include if 2FA is configured.

As a workaround, you can enforce 2FA in your IdP instead.