# MFA for enrolled users only

**URL:** <https://community.auth0.com/t/mfa-for-enrolled-users-only/192724>\
**Category:** Get Help\
**Tags:** one-time-password-otp-factor, mfa\
**Created:** [October 3, 2025, 8:30am UTC](https://community.auth0.com/t/mfa-for-enrolled-users-only/192724 "2025-10-03T08:30:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![scotts](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/scotts/32/25429_2.png) [@scotts](https://community.auth0.com/u/scotts)\
**Post date:** [October 3, 2025, 8:30am UTC](https://community.auth0.com/t/mfa-for-enrolled-users-only/192724/1 "2025-10-03T08:30:15Z")

</div>

Hi

I’d like to start allowing MFA to those users who want it, but not force it upon everyone. (Changing the MFA to ‘Always‘ appears to prompt everyone to enrol when they log in, so this is not an option.)

Is there a way, possibly with an action, to have a PostLogin event which checks if a user is enrolled in MFA, and if so, then triggers the MFA authentication process on every login? However, for users who are not enrolled (or just signing up), ignore MFA and log them in.

Thanks  
Scott

---

<div class="post-metadata">

**Author:** ![dawid.matuszczyk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dawid.matuszczyk/32/74550_2.png) [@dawid.matuszczyk](https://community.auth0.com/u/dawid.matuszczyk)\
**Post date:** [October 31, 2025, 3:05pm UTC](https://community.auth0.com/t/mfa-for-enrolled-users-only/192724/3 "2025-10-31T15:05:44Z")

</div>

Hi @scotts

Welcome back to the Auth0 Community!

Thank you for posting your question. You can achieve this by creating a Post-Login Action\*\* that inspects the `event.user.multifactor` array. If this array is not empty (meaning the user is already enrolled), you will use `api.multifactor.challenge()` to trigger the MFA prompt. If the array is empty, the Action does nothing, and the user logs in seamlessly.

```js
/**
* @param {Event} event - Details about the user and the context of the login.
* @param {PostLoginAPI} api - Interface to modify the login transaction.
*/
exports.onExecutePostLogin = async (event, api) => {
  if (event.user.multifactor && event.user.multifactor.length > 0) {

    // User is enrolled, so we must challenge them.
    api.multifactor.enable('any');
  }
};

```

> **[Customize Multi-Factor Authentication Pages](https://auth0.com/docs/secure/multi-factor-authentication/customize-mfa?utm_source=chatgpt.com)**
>
> Learn how to customize multi-factor authentication (MFA) pages that appear to users with Universal Login branding options.

> **[Login Trigger](https://auth0.com/docs/customize/actions/explore-triggers/signup-and-login-triggers/login-trigger#enforce-custom-mfa-policy)**
>
> Learn about the Actions Login Flow and the post-login Action trigger, which is executed after a user logs in and when a Refresh Token is requested.

Thanks  
Dawid

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 14, 2025, 3:06pm UTC](https://community.auth0.com/t/mfa-for-enrolled-users-only/192724/4 "2025-11-14T15:06:44Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.