# Force user to enroll a new MFA Authenticator using Universal Login **URL:** \ **Category:** Get Help\ **Tags:** mfa-api, mfa\ **Created:** [June 14, 2023, 2:41pm UTC](https://community.auth0.com/t/force-user-to-enroll-a-new-mfa-authenticator-using-universal-login/109237 "2023-06-14T14:41:41Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![simon.weckler](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@simon.weckler](https://community.auth0.com/u/simon.weckler)\ **Post date:** [June 14, 2023, 2:41pm UTC](https://community.auth0.com/t/force-user-to-enroll-a-new-mfa-authenticator-using-universal-login/109237/1 "2023-06-14T14:41:41Z")
Is there a way to redirect the User to a universal login page where he is forced to enroll a new MFA factor? We have an SPA using React and would like to allow the user to change his/her phone number used for MFA. The approach we wanted to take is the following because it doesn’t require us to build our own UI: 1. On the frontend, list and remove the MFA then force the user to sign in again, this will force them to enter a new phone number for MFA However this leaves the user without MFA for a short period of time which is a security issue. This is why we would like to know if there is an way to force the user to enroll a new authenticator without deleting the old first using universal login. ---
**Author:** ![kswanson321](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kswanson321/32/52071_2.png) [@kswanson321](https://community.auth0.com/u/kswanson321)\ **Post date:** [September 9, 2025, 1:47pm UTC](https://community.auth0.com/t/force-user-to-enroll-a-new-mfa-authenticator-using-universal-login/109237/2 "2025-09-09T13:47:01Z")
I’m interested in the answer to this. Can we get an Auth0 helper to respond please? ---
**Author:** ![gerald.czifra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gerald.czifra/32/75301_2.png) [@gerald.czifra](https://community.auth0.com/u/gerald.czifra)\ **Post date:** [September 9, 2025, 5:53pm UTC](https://community.auth0.com/t/force-user-to-enroll-a-new-mfa-authenticator-using-universal-login/109237/4 "2025-09-09T17:53:56Z")
Hi there, Welcome to the Auth0 Community and thank you for the interest in this use case! I believe the best approach in this situation is to utilize our [following endpoint](https://auth0.com/docs/api/management/v2/users/put-authentication-methods) in order to update the user’s authentication method. This way, a new MFA can be set for the new phone number without leaving the user without an MFA method. In addition, if you wish to prompt the user for MFA, a flow can be created based on the user’s app\_metadata ( that the user cannot edit ) - you can enrich it with something like `updated_number : true`, configure your [Action](https://auth0.com/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger) to trigger when this is detected and push the prompt. Once the MFA has been reset, the `updated_number` can be set to false. Hope this helped! Gerald ---
**Author:** ![kswanson321](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kswanson321/32/52071_2.png) [@kswanson321](https://community.auth0.com/u/kswanson321)\ **Post date:** [September 10, 2025, 6:56pm UTC](https://community.auth0.com/t/force-user-to-enroll-a-new-mfa-authenticator-using-universal-login/109237/5 "2025-09-10T18:56:53Z")
What about intializing an authorize call with the mfa audience, and having a postLoginAction that looks at the app\_metadata and conditionally requires them to enroll an additional factor? My app will receive the access token scoped to delete:autheniticators and I’ll clean up the old authenticator once back in the app. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [September 24, 2025, 6:57pm UTC](https://community.auth0.com/t/force-user-to-enroll-a-new-mfa-authenticator-using-universal-login/109237/6 "2025-09-24T18:57:30Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.