# Why enroll in SMS if Email factor is enrolled

**URL:** <https://community.auth0.com/t/why-enroll-in-sms-if-email-factor-is-enrolled/92445>\
**Category:** Get Help\
**Tags:** mfa-email, mfa-sms\
**Created:** [October 14, 2022, 6:45pm UTC](https://community.auth0.com/t/why-enroll-in-sms-if-email-factor-is-enrolled/92445 "2022-10-14T18:45:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![phi1ipp](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/phi1ipp/32/40616_2.png) [@phi1ipp](https://community.auth0.com/u/phi1ipp)\
**Post date:** [October 14, 2022, 6:45pm UTC](https://community.auth0.com/t/why-enroll-in-sms-if-email-factor-is-enrolled/92445/1 "2022-10-14T18:45:01Z")

</div>

Hi All,

Going through the labs I didn’t quite catch MFA enrollment requirements. The scenario is:

- user was enrolled into SMS and Email
- when logging in they can select which factor to use
- we do MFA reset
- management dashboard shows that the user is enrolled into Email only (makes sense)
- user tries to log in and get a dialog to enroll into SMS and not being able to use Email

Can somebody please help to understand this experience? Having Okta background I expected a different behavior, but, I guess, it’s not relevant here.

Thanks in advance,  
Philipp

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [October 27, 2022, 6:29pm UTC](https://community.auth0.com/t/why-enroll-in-sms-if-email-factor-is-enrolled/92445/3 "2022-10-27T18:29:40Z")

</div>

Hi @phi1ipp,

Welcome to the Auth0 Community!

According to [our blog post](https://auth0.com/blog/no-phone-no-problem-auth0-email-mfa-is-here/) on the matter:

> What about Email as the Only MFA Factor?
> 
> Currently, email MFA is only available as an optional backup multi-factor method. The user must have another method as the primary form of multi-factor authentication. Enabling email MFA as a standalone multi-factor method is on the Auth0 roadmap.

As for why; _Email_ and _password_ could be considered a single factor. If an attacker had access to a user’s email, they could also reset their password. We suggest requiring two separate factors, but you have the option of adding email.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 10, 2022, 6:30pm UTC](https://community.auth0.com/t/why-enroll-in-sms-if-email-factor-is-enrolled/92445/4 "2022-11-10T18:30:35Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.