# Enabling MFA for specific organizations in a single-tenant Auth0 setup — behavior for existing users? **URL:** \ **Category:** Get Help\ **Tags:** one-time-password-otp-factor, free-trial, mfa\ **Created:** [July 15, 2026, 9:04am UTC](https://community.auth0.com/t/enabling-mfa-for-specific-organizations-in-a-single-tenant-auth0-setup-behavior-for-existing-users/201678 "2026-07-15T09:04:11Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![sonam](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sonam/32/71228_2.png) [@sonam](https://community.auth0.com/u/sonam)\ **Post date:** [July 15, 2026, 9:04am UTC](https://community.auth0.com/t/enabling-mfa-for-specific-organizations-in-a-single-tenant-auth0-setup-behavior-for-existing-users/201678/1 "2026-07-15T09:04:11Z")
Hi everyone, My application uses a single Auth0 tenant that supports multi-organization authentication. We want to enable MFA only for some organizations — is that possible with this setup? Specifically: - Can MFA be enabled per organization (not tenant-wide) in Auth0? - If MFA is enabled for an existing organization, how does Auth0 handle existing user accounts in that org? Will users be prompted to enroll in MFA on next login, or is additional migration/configuration required? - Any recommended approach or pitfalls to watch for (rules, Actions, Guardian, custom flows, or required settings)? ---
**Author:** ![gerald.czifra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gerald.czifra/32/75301_2.png) [@gerald.czifra](https://community.auth0.com/u/gerald.czifra)\ **Post date:** [July 15, 2026, 11:07pm UTC](https://community.auth0.com/t/enabling-mfa-for-specific-organizations-in-a-single-tenant-auth0-setup-behavior-for-existing-users/201678/3 "2026-07-15T23:07:49Z")
Hi @sonam Welcome to the Auth0 Community! I understand that you are looking to enable Multi-Factor Authentication for users of a specific Organization in your single-tenant environment. While in general MFA settings are set on a tenant level, you can implement custom logic using a [Post-Login Action](https://auth0.com/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger/post-login-event-object) to trigger MFA based on a specific Organization. Allow me to share some details as to how this flow can be implemented: - **Disabled MFA for your tenant** : In you Auth0 Dashboard you can navigate to Security → Multi-Factor Auth, under **Define policies** select **Never** and Save changes. After this, toggle on the option to **Customize MFA Factors using Actions** ; - **Create a Post-Login Action to prompt for MFA per specific Organization** : Write logic in your Action so that users are selectively enforced to satisfy MFA when accessing a specific Organization, such as the following general example: ```auto exports.onExecutePostLogin = async (event, api) => { // Check if the user is logging into a specific organization if (event.organization && event.organization.id === 'org_123456789') { api.multifactor.enable('any', { allowRememberBrowser: true }); } }; ``` **Note** : please keep in mind that the `allowRememberBrowser` Flag changes the occurrence of MFA prompt. Setting it to `false` will strictly force the user to provide an MFA code on every single login attempt. Setting it to `true` allows the user to click “Remember this device” and skip the prompt on trusted browsers for up to 30 days, which dramatically reduces login friction. > [@sonam](#): > > - If MFA is enabled for an existing organization, how does Auth0 handle existing user accounts in that org? Will users be prompted to enroll in MFA on next login, or is additional migration/configuration required? When you enable MFA for an organization using this approach, existing users in that organization will be **[prompted to enroll in MFA on their next login](https://auth0.com/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-and-challenge-email-authenticators)**. Auth0 does not require additional migration or manual enrollment configuration — the enrollment prompt is automatic. Users will see the MFA enrollment screen during login and must complete it before gaining access. If a user dismisses the enrollment prompt, they will be prompted again on the next login attempt. Additionally, instead of hardcoding Organization IDs in your Action script, you can define a custom metadata field on the Auth0 Organization object itself (e.g., `require_mfa: true`). Your Action can then dynamically check this flag: ```auto if (event.organization && event.organization.metadata.require_mfa === 'true') { api.multifactor.enable('any', { allowRememberBrowser: true }); } ``` **Note** : - Ensure your application passes the organization parameter during the authentication request (e.g., `organization=org_123` in the authorize URL). If the organization context is missing, the Action cannot determine which organization the user belongs to; - thoroughly test these changes and verify that users in MFA-enabled organizations are prompted to enroll and that users in non-MFA organizations are not. Use the Auth0 Dashboard **Logs** section to monitor authentication events and enrollment prompts these changes before pushing them in a production environment so nothing. I can warmly recommend to take a look at the code snippet and general information from our following documentation on how to **[use metadata to determine challenge method](https://auth0.com/docs/secure/multi-factor-authentication/customize-mfa/customize-mfa-selection-universal-login#use-metadata-to-determine-challenge-method)** that focuses on Organization Metadata in it’s example. Hope this helped resolve your issue and implement the correct flow for your environment! Have a great one, Gerald ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [July 21, 2026, 9:24pm UTC](https://community.auth0.com/t/enabling-mfa-for-specific-organizations-in-a-single-tenant-auth0-setup-behavior-for-existing-users/201678/4 "2026-07-21T21:24:38Z")
This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.