How to Get SMS MFA Enrollments with Full Phone Numbers
Last Updated:
Overview
When bulk exporting users and looking at a user's profile, the phone number for SMS Multifactor Authentication (MFA) is obscured. The phone number is masked with"X", like in the following example: +1 XXXXXXXX1515. The same behavior is observed within an Action, Hook, or Rule.
This article explains whether it is possible to have the phone number available and unobscured, either in the bulk export or within an Action, Hook, or Rule.
Applies To
- Multifactor Authentication (MFA)
- SMS
- Masked Phone Numbers
- Bulk Export
Cause
By default, the Management APIv2 will obfuscate the phone numbers. This can be modified in the tenant settings by setting the disable_management_api_sms_obfuscation flag to true.
Solution
By default, the Management APIv2 will obfuscate the phone numbers, but it can be modified in the tenant settings to set the disable_management_api_sms_obfuscation flag to true.
Sample body to PATCH /api/v2/tenants/settings:
{
"flags": {
"disable_management_api_sms_obfuscation": true
}
}
After this, the full phone number will be available for each user in the bulk export, or within the JSON structure, as it follows:
{
"id": "sms|dev_lVJ5hIp2uFtypn5c",
"type": "sms",
"confirmed": true,
"name": "+54 1103034566",
"created_at": "2022-11-04T13:51:46.000Z",
"last_auth_at": "2022-11-04T13:52:21.000Z"
}
NOTE: For SMS, there are no MFA secrets, so it is not necessary to submit a request to have Engineering do an export.
The Bulk User Export feature can export the MFA factor type, but it does not export the actual enrollments, so use the Auth0 Management APIv2, which can fetch more detailed information about MFA enrollments.
For a visual demonstration, refer to the following video.
