Hello, In my setup the API has RBAC enabled as well as Add Permissions in the Access Token. At the same time there is a conditional MFA rule as following: function (user, context, callback) { if (context.clientID === ‘’ && user.user_metadata.use_mfa !== “false”) { context.multifactor = { prov…

Conditional multi-factor rule removes permissions from JWT

vitaliy.obideyko March 9, 2021, 11:09am 8

Now it have been fixed on Auth0 side

2 Likes