# Reseting MFA does not disable it

**URL:** <https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893>\
**Category:** Get Help\
**Created:** [June 18, 2020, 12:24am UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893 "2020-06-18T00:24:51Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![martin6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/martin6/32/13181_2.png) [@martin6](https://community.auth0.com/u/martin6)\
**Post date:** [June 18, 2020, 12:24am UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/1 "2020-06-18T00:24:51Z")

</div>

Hi,

I’m a bit confused on how to completly disable MFA for a specific user.

- User enrolled in MFA using the Gardian App
- In the Admin dashboard, I can see the MFA info and the text “User is enrolled on MFA. Reset MFA”
- If I click “Reset MFA”. The MFA info is cleared anf the text " MFA is enabled for this user. Send an enrollment invitation" is shown.

But…

If I get the user info from the Management API endpoint (https://{{auth0\_domain}}/api/v2/users/:id), the MFA info still appear as

“multifactor”: [  
“guardian”  
]

This element is not present for user that never enrolled into MFA.

Is it possible to clear this information from the user?

Thanks

Martin

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [June 18, 2020, 2:47pm UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/3 "2020-06-18T14:47:51Z")

</div>

Hey there!

Let me research that for you and get back here with the news soon!

---

<div class="post-metadata">

**Author:** ![emiel](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/emiel/32/33674_2.png) [@emiel](https://community.auth0.com/u/emiel)\
**Post date:** [July 23, 2020, 9:57am UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/4 "2020-07-23T09:57:13Z")

</div>

Hi there, can you tell me if this actually supported (disable MFA for one particular user) ?

---

<div class="post-metadata">

**Author:** ![martin6](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/martin6/32/13181_2.png) [@martin6](https://community.auth0.com/u/martin6)\
**Post date:** [August 26, 2020, 12:20pm UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/5 "2020-08-26T12:20:56Z")

</div>

Hi, any update on this issue?

Thanks

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [September 12, 2020, 4:32pm UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/6 "2020-09-12T16:32:51Z")

</div>

It is. Here’s how to do that:

> **[Reset User Multi-Factor Authentication and Recovery Codes](https://auth0.com/docs/secure/multi-factor-authentication/reset-user-mfa)**
>
> Learn how to reset a user's MFA in case they lose their mobile device and do not have a recovery code.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [September 12, 2020, 4:34pm UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/7 "2020-09-12T16:34:33Z")

</div>

Hey there Martin!

Sorry for the delay in response. It seems like there’s a problem in our stack as you performed the action via UI (resetting the MFA) and then you’re checking the users using the API and the UI tells one thing while the API tells the other. I submitted it as an internal engineering ticket and will update you on this one as soon as I have any info about the fix from the engineering team. Sorry for the inconvenience!

---

<div class="post-metadata">

**Author:** ![emiel](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/emiel/32/33674_2.png) [@emiel](https://community.auth0.com/u/emiel)\
**Post date:** [September 14, 2020, 7:14am UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/8 "2020-09-14T07:14:11Z")

</div>

Hi Konrad,

Thank you for your reply. This procedure will remove the MFA, but it’s only temporarily. As soon as the user tries logging in again he will need to setup MFA again.

I was asking this question because we’re trying to do automated tests with Cypress for our application. Using a predefined user for that scenario is doable, but when this user’s MFA is enabled, things become really hard.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [September 14, 2020, 9:58am UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/9 "2020-09-14T09:58:33Z")

</div>

Gotchya! I don’t have much of experience with Cypress but maybe if you can share that in this thread which is about end-to-end testing with Cypress somebody will be able to guide you:

> [@End-to-End Testing with Cypress and Auth0](https://community.auth0.com/t/end-to-end-testing-with-cypress-and-auth0/19082/85):
>
> No firm ETA as of yet for release but once it’s finished and it becomes available I will share it here first!

---

<div class="post-metadata">

**Author:** ![franciscop](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/franciscop/32/24725_2.png) [@franciscop](https://community.auth0.com/u/franciscop)\
**Post date:** [October 12, 2020, 5:44pm UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/10 "2020-10-12T17:44:24Z")

</div>

Hello,  
Any updates about this issue?  
I having this issue testing an authentication flow that i’m developing for my company that uses 2mfa. I’m using guardian-js1.3.2 in the custom mfa\_page, and after reset the mfa, the user can’t enroll again, it returns a conflict error.  
Any help would be great!  
Thanks.

---

<div class="post-metadata">

**Author:** ![emiel](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/emiel/32/33674_2.png) [@emiel](https://community.auth0.com/u/emiel)\
**Post date:** [October 20, 2020, 10:13am UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/11 "2020-10-20T10:13:39Z")

</div>

@franciscop I believe that that is by design. It looks like there’s a possibility to check if the user was already enrolled.  
“2. (optional) Check if the user is already enrolled. You cannot enroll twice.”

> **[GitHub - auth0/auth0-guardian.js: Client library for Auth0 Guardian](https://github.com/auth0/auth0-guardian.js/#enrollment)**
>
> Client library for Auth0 Guardian. Contribute to auth0/auth0-guardian.js development by creating an account on GitHub.

---

<div class="post-metadata">

**Author:** ![franciscop](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/franciscop/32/24725_2.png) [@franciscop](https://community.auth0.com/u/franciscop)\
**Post date:** [October 20, 2020, 12:09pm UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/12 "2020-10-20T12:09:05Z")

</div>

Hi @emiel, thanks for answer. I already found a solution with the auth0 support team. I leave here the solution:

I had the Email MFA enabled and by the docs this only works in New Universal Login. While I had ‘New’ toggled on in the Dashboard, i have turned on customizations which actually reverts it back to Classic Universal Login that does not support Email MFA.  
So, by the support team suggestion i turned off the Email MFA toggle in the Multifactor Auth tab of the Dashboard but leaving SMS on, then i cleared the user’s MFA again and all started to work fine.

Best regards,  
Francisco

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [October 21, 2020, 1:39pm UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/13 "2020-10-21T13:39:49Z")

</div>

Thanks for sharing that with the rest of community!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 5, 2020, 1:39pm UTC](https://community.auth0.com/t/reseting-mfa-does-not-disable-it/44893/14 "2020-11-05T13:39:54Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.
