My application uses a single Auth0 tenant that supports multi-organization authentication. We want to enable MFA only for some organizations — is that possible with this setup?
Specifically:
Can MFA be enabled per organization (not tenant-wide) in Auth0?
If MFA is enabled for an existing organization, how does Auth0 handle existing user accounts in that org? Will users be prompted to enroll in MFA on next login, or is additional migration/configuration required?
Any recommended approach or pitfalls to watch for (rules, Actions, Guardian, custom flows, or required settings)?
I understand that you are looking to enable Multi-Factor Authentication for users of a specific Organization in your single-tenant environment.
While in general MFA settings are set on a tenant level, you can implement custom logic using a Post-Login Action to trigger MFA based on a specific Organization. Allow me to share some details as to how this flow can be implemented:
Disabled MFA for your tenant: In you Auth0 Dashboard you can navigate to Security → Multi-Factor Auth, under Define policies select Never and Save changes. After this, toggle on the option to Customize MFA Factors using Actions;
Create a Post-Login Action to prompt for MFA per specific Organization: Write logic in your Action so that users are selectively enforced to satisfy MFA when accessing a specific Organization, such as the following general example:
exports.onExecutePostLogin = async (event, api) => {
// Check if the user is logging into a specific organization
if (event.organization && event.organization.id === 'org_123456789') {
api.multifactor.enable('any', { allowRememberBrowser: true });
}
};
Note: please keep in mind that the allowRememberBrowser Flag changes the occurrence of MFA prompt. Setting it to false will strictly force the user to provide an MFA code on every single login attempt. Setting it to true allows the user to click “Remember this device” and skip the prompt on trusted browsers for up to 30 days, which dramatically reduces login friction.
When you enable MFA for an organization using this approach, existing users in that organization will be prompted to enroll in MFA on their next login. Auth0 does not require additional migration or manual enrollment configuration — the enrollment prompt is automatic. Users will see the MFA enrollment screen during login and must complete it before gaining access. If a user dismisses the enrollment prompt, they will be prompted again on the next login attempt.
Additionally, instead of hardcoding Organization IDs in your Action script, you can define a custom metadata field on the Auth0 Organization object itself (e.g., require_mfa: true). Your Action can then dynamically check this flag:
Ensure your application passes the organization parameter during the authentication request (e.g., organization=org_123 in the authorize URL). If the organization context is missing, the Action cannot determine which organization the user belongs to;
thoroughly test these changes and verify that users in MFA-enabled organizations are prompted to enroll and that users in non-MFA organizations are not. Use the Auth0 Dashboard Logs section to monitor authentication events and enrollment prompts these changes before pushing them in a production environment so nothing.
I can warmly recommend to take a look at the code snippet and general information from our following documentation on how to use metadata to determine challenge method that focuses on Organization Metadata in it’s example.
Hope this helped resolve your issue and implement the correct flow for your environment!