Are SSO users automatically marked as email_verified? Is this 100% reliable?
I would like to avoid prompting the users for email verification if they are coming from an SSO provider.
Hi @simoesj
Not all SSO connections mark the email_verified property as verified after registration. For the cases of email passwordless and social logins, the property should be verified. For other connections such as enterprise ones, the property should be unverified. If you wish to bypass these users to verify their email upon registration, I would suggest using an action which would disable the MFA verification for these kind of users if you are enforcing it for default ones like that, otherwise, if an user signs up through one of these connections, they should not be asked to verify their email.
If you have any other questions, let me know!
Kind Regards,
Nik