# B2B Multi tenant MFA

**URL:** <https://community.auth0.com/t/b2b-multi-tenant-mfa/61713>\
**Category:** Get Help\
**Tags:** organizations\
**Created:** [April 26, 2021, 4:58am UTC](https://community.auth0.com/t/b2b-multi-tenant-mfa/61713 "2021-04-26T04:58:40Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![kartik.cds](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kartik.cds/32/29019_2.png) [@kartik.cds](https://community.auth0.com/u/kartik.cds)\
**Post date:** [April 26, 2021, 4:58am UTC](https://community.auth0.com/t/b2b-multi-tenant-mfa/61713/1 "2021-04-26T04:58:40Z")

</div>

For my multi-tenant Saas Application, I am using a separate Application \<-\> Connection per customer.

Customers selectively are requesting for MFA. How Can I enable MFA for few customers and disable MFA for others. Basically, Can I enable/disable MFA per application or per connection ?

---

<div class="post-metadata">

**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\
**Post date:** [April 26, 2021, 2:43pm UTC](https://community.auth0.com/t/b2b-multi-tenant-mfa/61713/2 "2021-04-26T14:43:04Z")

</div>

Hi @kartik.cds

Have you tried Auth0 Organizations? They may apply in your case.  
[https://auth0.com/docs/organizations](https://auth0.com/docs/organizations)

To do your MFA, choose the “Never” option for MFA on the MFA page, and then use a rule to selectively enable MFA, There are several sample rules to choose from to get you started.

John

---

<div class="post-metadata">

**Author:** ![adam.housman](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/adam.housman/32/19907_2.png) [@adam.housman](https://community.auth0.com/u/adam.housman)\
**Post date:** [April 26, 2021, 3:41pm UTC](https://community.auth0.com/t/b2b-multi-tenant-mfa/61713/3 "2021-04-26T15:41:08Z")

</div>

If using [Organizations](https://auth0.com/docs/organizations), you could store this at the organization metadata layer and then use a rule to trigger MFA.

```auto
function multifactorAuthentication(user, context, callback) {
  //Make sure the rule runs only for the application you are concerned about.
  if (context.clientID === 'REPLACE_WITH_YOUR_CLIENT_ID') { 
    // Run MFA for organizations that have metadata property called "mfa" set to "true"
    if (context.organization && context.organization.metadata && context.organization.metadata.mfa && context.organization.metadata.mfa == "true") { 
      context.multifactor = {
        provider: 'any',
        // optional, defaults to true. Set to false to force authentication every time.
        // See https://auth0.com/docs/multifactor-authentication/custom#change-the-frequency-of-authentication-requests for details
        allowRememberBrowser: false
      };
    }
  }
  callback(null, user, context);
}

```

Alternately you could set the MFA provider that should be used in the org metadata…

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [April 26, 2021, 3:48pm UTC](https://community.auth0.com/t/b2b-multi-tenant-mfa/61713/4 "2021-04-26T15:48:14Z")

</div>

Thanks for engaging in this one @adam.housman and @john.gateley !

---

<div class="post-metadata">

**Author:** ![kartik.cds](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kartik.cds/32/29019_2.png) [@kartik.cds](https://community.auth0.com/u/kartik.cds)\
**Post date:** [April 26, 2021, 7:24pm UTC](https://community.auth0.com/t/b2b-multi-tenant-mfa/61713/5 "2021-04-26T19:24:49Z")

</div>

Thanks @john.gateley @adam.housman for the prompt response. Organizations is good (but needs enterprise/startup license for that), but my use-case is well satisfied with the Application \<-\> Connection combo…  
I will try your suggestion of using Rules with clientID conditions for application specific MFA.

Thanks again.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [April 27, 2021, 9:28am UTC](https://community.auth0.com/t/b2b-multi-tenant-mfa/61713/6 "2021-04-27T09:28:29Z")

</div>

No worries! Let us know if you have any further questions!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [May 12, 2021, 9:28am UTC](https://community.auth0.com/t/b2b-multi-tenant-mfa/61713/7 "2021-05-12T09:28:55Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.