MFA not required even though factor is enabled?

Get Help
,
1

We’re on the B2C Essentials plan. We have “One-time Password” enabled under “Security > Multi-factor Auth”, but new users logging in for the first time no longer seem to be required to use it. Is there another setting somewhere I’m missing that enforces the requirement of this factor?

Screenshot 2025-03-17 at 5.07.38 PM
Screenshot 2025-03-17 at 5.07.38 PM621×151 8.74 KB

3

HI @johnwp

Welcome back to the Auth0 Community!

Have you set your Require Multi-factor Auth policy to Always?

If not, what is the policy set and how are you enforcing MFA for your users?

Do you customize the MFA using actions?

Looking forward to your answer!

Kind Regards,
Nik

1 Like
4

I seem to have missed that setting. I have it enabled now. Thanks for the tip!

5

@nik.baleca If I wanted to only require MFA for one application, would I do that as a custom action?

6

Hi again.

Yes! Your action would look something like this:

exports.onExecutePostLogin = async (event, api) => {

  if(event.client.client_id === 'YOUR_CLIENT_ID') {
    api.multifactor.enable('any');
  }

};
1 Like
7

When I enable that action, it goes into an infinite MFA loop. Any ideas on what’s happening?

8

I see.

Since you are looking to enable the MFA only for one application. I would recommend to set the MFA Policy to Never so that you can control it within the actions.

Once you set it to never, the action should prompt the users to enroll into MFA on signup or complete the challenge.

Let me know if you have any other issues!

Kind Regards,
Nik

9

I ended up adding some additional code to prevent the infinite MFA loop. We seem to have lost the “Remember for 30 days” option on the MFA screen. Is there a way we can get that option back?

exports.onExecutePostLogin = async (event, api) => {
  if(event.client.client_id === event.secrets.clientId) {

    if (event.transaction?.protocol === "oauth2-refresh-token") {
      return;
    }

    const completedMfa = event.authentication?.methods.some(
      (method) => method.name === "mfa"
    );

    if (completedMfa) {
      return;
    }

    api.multifactor.enable('any');
  }
};
10

Hi,

You could try the following:

api.multifactor.enable('any', { allowRememberBrowser: true });

This will display the button on the screen for the user.

Let me know if I can help with anything else!

Kind Regards,
Nik