# Enable/disable WebAuthn (biometrics) per user based on user\_metadata or some other flag? **URL:** \ **Category:** Get Help\ **Tags:** login-experience, new-universal-login-experience\ **Created:** [February 23, 2026, 3:04pm UTC](https://community.auth0.com/t/enable-disable-webauthn-biometrics-per-user-based-on-user-metadata-or-some-other-flag/197566 "2026-02-23T15:04:20Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![somnio-bf](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/somnio-bf/32/73229_2.png) [@somnio-bf](https://community.auth0.com/u/somnio-bf)\ **Post date:** [February 23, 2026, 3:04pm UTC](https://community.auth0.com/t/enable-disable-webauthn-biometrics-per-user-based-on-user-metadata-or-some-other-flag/197566/1 "2026-02-23T15:04:20Z")
Hi everyone, I’m working on a mobile application using Universal Login (New Experience), and I’m trying to determine whether it’s possible to dynamically enable or disable WebAuthn (device biometrics) per user based on a flag stored in `user_metadata` (or via any other supported mechanism). ### Desired Behavior We would like the flow to work as follows: 1. User logs in for the first time (username + password). 2. User enrolls in MFA. 3. User is prompted to enable WebAuthn (webauthn-platform). 4. User logs out. On the next login: 1. User enters their username. 2. If biometrics are enabled, the user can authenticate using WebAuthn only. Later: 1. The user disables “biometric login” in their profile settings inside the app. 2. User logs out. On the following login: 1. User enters their username. 2. WebAuthn should NOT be requested. 3. Standard login + MFA should be required again. Based on this example, could you please clarify if it is possible to dynamically control WebAuthn availability per user (based on metadata) when using Universal Login? Thank you! ---
**Author:** ![gerald.czifra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gerald.czifra/32/75301_2.png) [@gerald.czifra](https://community.auth0.com/u/gerald.czifra)\ **Post date:** [February 24, 2026, 1:44am UTC](https://community.auth0.com/t/enable-disable-webauthn-biometrics-per-user-based-on-user-metadata-or-some-other-flag/197566/3 "2026-02-24T01:44:20Z")
Hi @somnio-bf Welcome to the Auth0 Community! Please allow me some time to research this and I will be back with some information. Best regards, Gerald ---
**Author:** ![gerald.czifra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gerald.czifra/32/75301_2.png) [@gerald.czifra](https://community.auth0.com/u/gerald.czifra)\ **Post date:** [February 24, 2026, 10:05pm UTC](https://community.auth0.com/t/enable-disable-webauthn-biometrics-per-user-based-on-user-metadata-or-some-other-flag/197566/4 "2026-02-24T22:05:45Z")
Hi @somnio-bf Thank you for your patience! Reading through your use-case, I would say that it should definitely be possible to dynamically set the behaviour of WebAuthn based on `user_metadata` with the use of [Post-Login Trigger](https://auth0.com/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger/post-login-event-object). The flow design that you suggested speaks for itself I should say: - Steps 1-6: Normal Universal Login flow of a new user account creation and them being prompted to enroll in MFA factors. Their `user_metadata` flag `biometric_enabled = true` should be set sometime this point by your application making a call to the Management API’s [Update a User](https://auth0.com/docs/api/management/v2/users/patch-users-by-id) endpoint, once the user enables WebAuthn. I recommend reading through out Support Article on [How to Enable MFA for a Subset of Users](https://support.auth0.com/center/s/article/How-To-Enable-MFA-For-A-Subset-of-Users); - Step 7: Your application will make the call to the Update a User endpoint to set `biometric_enabled = false`. I can recommend the following Article that goes over how to [Enable MFA per User and Give Users the Option to Turn It On/Off Themselves](https://support.auth0.com/center/s/article/Enable-MFA-Per-User-And-Give-Users-The-Option-To-Turn-It-On-Off-Themselves), which is a great suit for your case; - Steps 8-11: User authentication flow will be handled via another Post-Login Action that reads the flag in the `user_metadata` and conditionally handles MFA/WebAuthn prompts. Allow me to provide some additional resources that can provide more information for implementing your desired flow: - [Using Actions to Customize Your MFA Factors](https://auth0.com/blog/using-actions-to-customize-your-mfa-factors/); - [Configure WebAuthn with Device Biometrics for Passwordless Authentication](https://auth0.com/docs/authenticate/login/auth0-universal-login/passwordless-login/webauthn-device-biometrics#multi-factor-authentication:~:text=authenticate%20with%20the-,webauthn%2Dplatform,-authentication%20method%3A). Hopefully this helps you tinker with the flow until it is exactly as intended for your use-case, but do let me know if you encounter any roadblocks along the way. Freely reach out to us for any other issues or requests and we will be glad to help! Have a great one, Gerald ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 10, 2026, 10:06pm UTC](https://community.auth0.com/t/enable-disable-webauthn-biometrics-per-user-based-on-user-metadata-or-some-other-flag/197566/5 "2026-03-10T22:06:09Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.