How is MFA meant to work NOW?

[neil_brennan]

Pretty much all of the online documentation for this feature appears to be out of date. For example:

How to Enable MFA for a Subset of Users

Last updated: Jul 31, 2024 Overview By default, once Multi-Factor Authentication (MFA) is enabled, it applies to all users in the tenant. This article details how MFA can be enabled for specific users. Applies To Multifactor Authentication (MFA) Solution First, ensure the tenant has the Require Multi-factor Auth set to None. Note that this setting will be overridden when MFA is implemented using Rules/Actions. Therefore, using Rules/Actions to conditionally enable MFA for specific users. NO…

I logged in to try to test this for just my own user, and found a great new “Send an enrollment invitation” link:

Clicking on the button did indeed send me an enrolment email:

But sadly, clicking on that email sends me to a screen with a loooonnng wait that just eventually times out:

How is this meant to work? What did I do wrong? Is there any current documentation (I can’t find it!).

Thanks for your help.

Neil

[vlad.murarasu]

Hi @neil_brennan,

As long as the Multi-factor Authentication is turned on in the dashboard, users should be able to enroll using the email.

Could you provide the settings for the Multi-factor Authentication?

Have a good one,
Vlad

[neil_brennan]

Thanks for your response.

Can you be more specific? “Multi-factor Authentication is turned on in the dashboard”. Where exactly?

Is there any actual documentation for this? Why does the system even send an email if it can’t be actioned? Why is the link visible in the UI if the feature is not turned on?

[vlad.murarasu]

Here is the documentation for MFA using Auth0.

Multi-Factor Authentication (MFA)

In your Auth0 dashboard, under Security > Multi-factor Auth, you should see multiple MFA factors:

After you activate the factors you desire and click on the “Send an enrollment invitation” link on a specific user, they will be able to enroll.

If you do not enjoy the user experience of the “Send an enrollment invitation” link being present even when MFA is turned off, you can submit a Feature Request.

Product Feedback

If you have any other questions, feel free to reach out.

Have a good one,

Vlad

[neil_brennan]

It seems the current Auth0 choices are: mandatory for all users, never for any users, or magic.

I did try turning on various auth factors in a test account. I was unable to get them to work in any way without upgrading the plan for that account, which I am not going to do.

I have no idea if the Rules/Actions hackery is still the way to turn it on for an individual, but honestly this far into the auth journey I really don’t care. It’s either system supported properly or not, and the Auth0 answer appears to be “not”.

Finally, I won’t be submitting any kind of feature requests for your broken UX. Honestly dude, I appreciate your attention on my query, but that’s your job.

Thanks for your help, but after reading the documentation I am abandoning this. There are other, much easier (and cheaper) options out there.

Kind regards,
Neil