Overview
After setting the preferred MFA method to “Voice”, users are still prompted to choose between SMS and Voice during login instead of being directly routed to the Voice call option. However, when setting “SMS” as the preferred method, the user is correctly routed to the SMS page without any selection prompts.
Steps to Reproduce:
- Voice Scenario
- Enroll a user in MFA using the Voice method and set the preferred_authentication_method to “Voice.”
- The user is still shown a page with options to choose between SMS and Voice during login.
- SMS Scenario
- Enroll a user in MFA using the SMS method and set the preferred_authentication_method to “SMS.”
- The user is correctly routed directly to the SMS page during login, skipping the method selection prompt.
This article explains the behavior observed and described above and clarifies what is expected based on system limitations.
Applies To
- Multifactor Authentication (MFA)
- Phone Factors
- “Voice” as the default method for receiving verification authentication codes
Cause
This behavior is how Auth0 handles the “Voice” option as a preferred authentication method. Even though the “preferred_authentication_method” is set to “Voice”, the system still presents the user with the option to select between SMS and Voice on the login page. In contrast, when “SMS” is set as the preferred method, the user is directly routed to the SMS page.
Solution
The current behavior is expected. While users can skip the method selection page when SMS is the preferred method, it is not possible to bypass this page and directly route users to the Voice call option, even when “Voice” is set as the preferred method.
There is currently no way to bypass the “How do you want to receive the code?” page for the Voice method. The behavior is likely enforced to mitigate security concerns such as toll fraud, which can occur with unauthorized use of Voice call services.