User notifications for when MFA is changed

Get Help
1

Hello,

I’m looking for ways to notify users whenever their MFA options change. Log Streams seemed like a good candidate but I was told our contract with Auth0 seems to have limited this option. Does Auth0 happen to have any other automated way to send users notifications for when their MFA options change?

3

Hi @michael.tan

Welcome to the Auth0 Community!

You are asking whether Auth0 provides an automated way to email users when their Multi-Factor Authentication options change, because Log Streams is not available under your contract.

[Summary]

Auth0 does not have a native, out-of-the-box automated feature or email template for notifying users when their MFA options or enrolled authenticators change (such as adding or removing an authenticator).

Auth0’s built-in transactional email templates only support specific lifecycle events (e.g., MFA enrollment invitations, OTP verification codes, password resets, and breached password alerts). Furthermore, Auth0 Actions currently does not offer an asynchronous mfa-change or factor lifecycle trigger.

[Recommended Workarounds]

If Log Streams are constrained by your tenant plan, here are the viable automated patterns to achieve this:

1. Scheduled Polling of the Management API Logs (GET /api/v2/logs)

Instead of streaming logs in real time, a lightweight background worker (such as an AWS Lambda function or cron job) can poll Auth0’s log endpoint:

  • How it works: Poll GET /api/v2/logs using checkpoint pagination (from={checkpoint_id}&take=100) to find specific MFA event types.

  • Relevant Log Event Types to watch for:

    • gd_enrollment_complete: Guardian MFA enrollment complete

    • gd_unenroll: Guardian MFA authenticator removed/unenrolled

    • gd_otp_enrollment_complete: TOTP/authenticator app enrolled

    • gd_otp_unenroll: TOTP/authenticator app unenrolled

    • gd_recovery_code_regenerate: Recovery code regenerated

  • Action: When matching log entries are detected, retrieve the user’s email from the log record (or fetch the user profile) and dispatch a notification email using your transactional email provider (SendGrid, AWS SES, Postmark, etc.).

2. Application Backend via Custom MFA Management UI

If users manage their MFA methods through a custom portal or profile settings page in your application (calling Auth0’s MFA API or the Management API /api/v2/users/{id}/authentication-methods):

  • How it works: Handle the addition, update, or deletion of authenticators via your own backend service.

  • Action: Upon receiving a successful response from Auth0’s API, your backend immediately triggers a confirmation/security notification to the user via your notification pipeline.

3. Post-Login Action with Factor State Diffing

If changes typically occur during an active session and you do not want external polling infrastructure:

  • How it works: In a Post-Login Action, compare the user’s current MFA factors/methods (using the Management API Client within the Action or checking event.user.multifactor) against a snapshot stored in event.user.app_metadata.mfa_snapshot.

  • Action: If a discrepancy is detected (e.g., factor added or removed since previous login), make an HTTP call to your transactional email service to notify the user, then update mfa_snapshot in app_metadata.

  • Trade-off: This only triggers upon subsequent logins rather than asynchronously at the exact second a factor is altered.

Kind Regards,
Nik