This article explains why deleting a Multi-Factor Authentication (MFA) factor does not automatically remove a trusted device cookie or invalidate current user sessions. Calling the DELETE /v2/guardian/enrollments/{id} endpoint only removes the specific MFA factor and does not affect any sessions or cookies that may have been established.

• Management API
• Multifactor Authentication

A session or a trusted device cookie, once created, becomes independent of the MFA factor used for the initial authentication. The session and cookie establish a trusted relationship with the user's device or browser and do not need to reference the original authenticator again until they are invalidated.

The endpoint for deleting an MFA factor is designed to only affect the list of available factors for a user. It does not affect any current activities or sessions.

To remove an MFA factor, end any associated session, and invalidate all trusted device cookies, three separate Management API endpoints must be called.

1. To delete the MFA factor, call the DELETE /v2/guardian/enrollments/{id} endpoint.

2. To invalidate any sessions authenticated by that factor, call the DELETE /api/v2/users/{user_id}/sessions endpoint. For more information, see Delete User Sessions.

3. To invalidate the trusted device cookie for the user, call the POST /api/v2/users/{id}/multifactor/actions/invalidate-remember-browser endpoint. This action invalidates all remembered browsers for the specified user. For more information, see Invalidate Remember Browser.