How to enforce a single MFA for a user

[rueben.tiow]

Hi @rajivk,

Thank you for your clarification.

If SMS and OTP are both enabled for the user, then it is normal to see a message indicating that the user is already enrolled in those factors. Therefore, calling the /mfa/associate endpoint for that user is not needed since they have already enrolled in both SMS and OTP MFA factors.

At this point, you can proceed by calling the /mfa/challenge endpoint for OTP/SMS generation, and verify MFA for OTP/SMS by calling the /oauth/token endpoint.

@rajivk

I tried it using API mentioned in previous replies and i can not configure more than one MFA at a time for a user. Could you share any docs or article that says it is even possible in Auth0.

You should be able to configure more than one MFA factor for a user at a time. Our Enable Multi-Factor Authentication documentation explains that:

“In the Factors section, choose the factors that you want to enable with toggles. Any or all of these factors can be enabled simultaneously.”

Please see these resources on enrolling SMS and OTP MFA:

• Enroll and Challenge SMS and Voice Authenticators
• Enroll and Challenge OTP Authenticators

Thank you.