Testing Adaptive MFA

[ashish.jamthe1]

Help required with simulating low confidence for adaptive MFA
We are trying to turn on Adaptive MFA for a certain user types, for which we have to customize Adaptive MFA. We are essentially going to check for the out of box riskAssessment.confidence score, if it is low, the trigger MFA (by calling api.multifactor.enable(“any”, { allowRememberBrowser: true });).
I am trying to test this, and finding it hard to get a low score. Our tenants are locked in to corporate IPs which makes it difficult to create impossible travel scenario. Is there any way, I could simulate a low confidence score. (Any way to add one of our corporate IPs to UntrustedIP list for my tenancy, would be ideal).

[vlad.murarasu]

Hi @ashish.jamthe1,

Welcome to the Auth0 Community!

I have found this Knowledge article, which should come in handy:

How to test adaptive MFA?

Question: How can I get low confidence scores for the MFA assessors used in adaptive MFA? Answer: In order to trigger a low confidence score for the UntrustedIPs assessor, one can perform an interactive login through a Tor browser. In order to trigger a low confidence score for the NewDevice assessor, for a returning user, one can 1) clear all browser cookies for the domain, and 2) alter their User-Agent string (ex. use a different browser than the previous login attempt, or artificially…

If you have any other questions, feel free to reach out.

Have a good one,
Vlad