Adaptive MFA Blocking Apple App Store Review

Get Help
, ,
1

Hi,
we have enabled Adaptive MFA for our application. We are currently submitting the app for review in the Apple App Store, and Apple’s review team is using a dedicated test account that we have provided.

During the review process, the test account was classified as risky, which triggered Adaptive MFA. As a result, the reviewer is required to complete an MFA challenge via a verification code sent to the email address associated with the test account.

The issue is that the Apple reviewer does not have access to this email mailbox and therefore cannot retrieve the verification code. Apple does not provide us with a separate test account or access to the reviewer’s environment; we are required to provide a fully functional test account that allows the review team to access the application without additional intervention.

This currently prevents the Apple reviewer from completing the review.

Is it possible to

  • disable Adaptive MFA for this specific test account, or
  • exclude the test account from Adaptive MFA/risk-based MFA policies

We would like to keep Adaptive MFA enabled for all other users and only exempt the dedicated Apple App Store review account.

3

Hi @Alois.Goeth

You have enabled Adaptive MFA for your application, but the Apple App Store review team's test account is being flagged as risky and required to complete MFA. Since the reviewer cannot access the email mailbox for the verification code, the review is blocked. You want to exclude this specific test account from Adaptive MFA while keeping it enabled for all other users.

Yes, you can disable Adaptive MFA for a specific test account by adding a flag to the account's app_metadata and creating a Post-Login Action that checks for this flag. This allows you to exempt the test account from MFA while keeping Adaptive MFA enabled for all other users.

[Root Cause]

Adaptive MFA is enabled globally for your application, which means all users—including the test account—are subject to risk assessment. When the test account is flagged as risky, Auth0 requires MFA completion. Since the reviewer cannot access the email mailbox, they cannot retrieve the verification code and cannot proceed.

Solution: Exempt the Test Account from Adaptive MFA Using a Post-Login Action

Step 1: Add a Flag to the Test Account's app_metadata

  1. Navigate to Auth0 Dashboard → Users & Roles → Users
  2. Find and click the test account (the one used by Apple reviewers)
  3. Scroll down to the app_metadata section
  4. Add the following JSON:
{
  "skip_mfa": true
}
  1. Click Save

Step 2: Enable "Customize MFA using Actions"

This setting allows your Post-Login Action to override Adaptive MFA:

  1. Navigate to Auth0 Dashboard → Security → Multi-factor Auth
  2. Scroll down to Customize MFA using Actions
  3. Toggle it ON
  4. Save

Step 3: Create a Post-Login Action to Skip MFA for the Test Account

  1. Navigate to Actions → Library → Create Action
  2. Name it "Skip MFA for Test Accounts"
  3. Select "Login / Post-Login" as the trigger
  4. Add the following code:
exports.onExecutePostLogin = async (event, api) => {
  // Check if the user has skip_mfa flag in app_metadata
  if (event.user.app_metadata && event.user.app_metadata.skip_mfa === true) {
    // Disable MFA for this user
    api.multifactor.enable('none');
    console.log(`MFA skipped for user: ${event.user.email}`);
    return;
  }
  
  // For all other users, Adaptive MFA continues to work as configured
};
  1. Deploy the Action

Step 4: Add the Action to Your Login Flow

  1. Navigate to Actions → Flows → Login
  2. Drag and drop your "Skip MFA for Test Accounts" Action into the flow
  3. Save the flow

Step 5: Test the Setup

  1. Log in with the test account — You should NOT be prompted for MFA
  2. Log in with a regular user account — Adaptive MFA should still work as expected
  3. Verify the test account can complete the Apple review without MFA interruption

Alternative: Use User Metadata Instead of app_metadata

If you prefer to use user_metadata instead of app_metadata:

exports.onExecutePostLogin = async (event, api) => {
  // Check if the user has skip_mfa flag in user_metadata
  if (event.user.user_metadata && event.user.user_metadata.skip_mfa === true) {
    api.multifactor.enable('none');
    console.log(`MFA skipped for user: ${event.user.email}`);
    return;
  }
};

Important Notes:

  1. app_metadata is recommended — Use app_metadata instead of user_metadata because users have read-only access to app_metadata and cannot modify it themselves, whereas they can modify user_metadata. This prevents the test account from re-enabling MFA on their own.
  2. Adaptive MFA remains active for other users — Only the test account with skip_mfa: true will bypass MFA. All other users will continue to experience Adaptive MFA as configured.
  3. Remove the flag after review — Once Apple completes the review, remove the skip_mfa: true flag from the test account's app_metadata to re-enable MFA protection.
  4. Multiple test accounts — If you have multiple test accounts that need to skip MFA, add the skip_mfa: true flag to each account's app_metadata.

Troubleshooting:

  • MFA is still being triggered — Ensure you have enabled "Customize MFA using Actions" in the Security → Multi-factor Auth settings
  • Action is not running — Verify the Action is deployed and added to the Login flow
  • app_metadata is not saving — Make sure you are editing the correct user and clicking Save after adding the JSON

Security Recommendation:

After the Apple review is complete, remove the skip_mfa: true flag from the test account to restore MFA protection. You can re-add it for future reviews if needed.

This approach allows you to provide Apple with a fully functional test account that bypasses MFA while maintaining Adaptive MFA protection for all production users.

Kind Regards,
Nik