User Export - Multifactor Methods

Get Help
,
1

I need to get a list of all ~50k users and their multifactor enrollments and types. I am trying to do this via the export users function and when I add a field to the user export like guardian_enrollments[0].type I don’t see any data in that field. Is this operation supported by the export function?

3

Hi @markEs

Thank you for reaching out to us!

You are asking whether the Auth0 user export can include each user's multifactor enrollments and their factor types, using the field guardian_enrollments[0].type, for about 50,000 users.

Root Cause: The user export does not include the guardian_enrollments field or per-enrollment details. Adding a path like guardian_enrollments[0].type returns no data because the export does not support that field.

Solution: Export the multifactor attribute, which lists the multifactor providers each user has enrolled. For per-enrollment detail, such as each factor's type and enrollment date, call the per-user authentication methods endpoint for the users who need it.

  1. Add the multifactor attribute to the export field list. In the User Import/Export extension, add multifactor[0] as a user attribute. In the Management API, add { "name": "multifactor" } to the fields array when you create the export users job with POST /api/v2/jobs/users-exports.
  2. Run the export job and download the resulting file. The multifactor column lists each user's enrolled providers, such as guardian, which indicates whether the user has an MFA factor and which type.
  3. Retrieve full enrollment details only for the users you need. Call GET /api/v2/users/{id}/authentication-methods for each user. Expect this to take longer at 50,000 users, so run it in batches with rate limiting in mind.
  4. Avoid looping over all users with per-user calls if you only need enrollment status. The multifactor column from the export or the List Users endpoint is sufficient for counting users who have enrolled.
  5. Confirm the factor types in your tenant. Factors other than Auth0 Guardian require an active Professional subscription, so check your subscription before planning the export.

This is also mentioned in the knowledge article about Multifactor Attribute in the User Profile when Exporting
Hope this helped you!

Best regards,
Gerald

4

Thanks @gerald.czifra . Do you know if you can access properties within multifactor[0] to see the type beyond just guardian? I’m really trying to see the property value for guardian_authenticators[0].type on the user profile and I noticed that I can’t get any value besides the first array element and none of the underlying properties are available.