The event.user.multifactor property from the Actions Triggers: post-login - Event Object always returns an empty array if a user lacks enrollments, or returns ['guardian'] if one or more Multi-Factor Authentication (MFA) factors exist. This occurs because the property only checks if the user is enrolled in MFA, rather than listing specific factors. Calling the Management Application Programming Interface (API) endpoints to retrieve enrollments resolves the issue.

• Auth0
• Actions
• Multi-Factor Authentication (MFA)

The intent of the event.user.multifactor property is to check if the user is enrolled in MFA. If enrolled, it always returns the value ['guardian']. In the Auth0 Dashboard, under the user profile page Raw JSON tab, the guardian_authenticators attribute shows the enrolled authenticators. However, this attribute is not available in Rules or Actions.

How are specific MFA factors retrieved in Actions?

As a workaround, call the Management API endpoints to retrieve the specific MFA enrollments for a user.

• Use /api/v2/users/{id}/enrollments to see if the user has a confirmed MFA enrollment.
• Call the GET /api/v2/users/{id}/authentication-methods endpoint to retrieve all enrollments.

NOTE: Be aware of the rate limits when calling the Management API in Actions or Rules.

Related References

• Actions Triggers: post-login - Event Object
• GET /api/v2/users/{id}/authentication-methods