Not able to refresh token if mfa is eanbled (Error: mfa_required)

[tyf]

Hi there @ydeng welcome to the community!

You may want to look into writing an Action that utilizes the oauth2-refresh-token property listed under event.transaction here:

Actions Triggers: post-login - Event Object

Some more on what conditional mfa may look like can be found in the following FAQ:

How To Enable MFA for a Subset of Users

Problem Statement By default, once MFA is enabled, it applies to all users in the tenant. Is it possible to enable MFA for specific users? Solution First, ensure the tenant has the Require Multi-factor Auth set to None. Note that this setting will be overridden when MFA is implemented using Rules/Actions. Therefore, using Rules/Actions to conditionally enable MFA for specific users. The MFA challenge can be set up to be based on the user attribute on their profile. Here are the steps: Set th…

Hope this helps!