"User is already enrolled" Error when Enrolling More than One MFA Factors using MFA API

Last Updated: Sep 10, 2025

Overview

I want to give user to select two method which is email and sms.
I am using mfa api and looks like working fine so far.
However, I have encountered an issue.
Here is a step for it.
1. I created a user
2. this user is required to verify with mfa
3. The user selects a sms for mfa and enrolled his phone number and did all things to get id token. It worked perfectly.
4. Next time, he wants to verify with another method,which is email.
5. However, when he tried to enroll email, auth0 returns "User is already enrolled" error.

Symptoms

When a user enrolled a MFA factor using the MFA API (e.g. SMS) and tries to enroll another MFA factor (e.g. email), the MFA API (`POST /mfa/associate` endpoint) returns "User is already enrolled" error.

Steps to reproduce

Customer's steps to reproduce:
1. I created a user
2. this user is required to verify with mfa
3. The user selects a sms for mfa and enrolled his phone number and did all things to get id token. It worked perfectly.
4. Next time, he wants to verify with another method,which is email.
5. However, when he tried to enroll email, auth0 returns "User is already enrolled" error.

Applies To

MFA
API MFA Token
Enroll factor

Cause

There are 2 types of MFA token:
1) If the MFA is enabled and the user tries to login via ROPG, a MFA token is returned to call the MFA API for MFA challenges. This MFA token can also be used to enrol MFA if the user has no existing MFA factors enrolled.
This MFA token looks like this "Fe26.2*bff..."
2) Request an access token with `audience` of `https://YOUR_DOMAIN/mfa/`, it can be requested via ROPG or `GET /authorize` endpoint. Depending on the scopes granted, this MFA token can be used to enrol, list and delete MFA factors.
https://auth0.com/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/manage-authenticator-factors-mfa-api#scopes
This MFA token is a JWT

The customer is using the MFA token of type 1 to enrol the 2nd MFA factor (email)

Troubleshooting

In the document (https://auth0.com/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-and-challenge-email-authenticators), it says:
> If you get a `User is already enrolled` error, the user already has an MFA factor enrolled. Before associating another factor with the user, you must challenge the user with the existing factor.

Solution

The procedure of enrolling 2nd and further factors is a bit different to the 1st factor.
1) Obtain the MFA Token with `audience` of `https://YOUR_DOMAIN/mfa/` and scope of `enroll`
You can obtain the MFA token via either Universal Login or Resource Owner Password Grant, as described in the document below:
https://auth0.com/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/manage-authenticator-factors-mfa-api#get-mfa-api-access-tokens
For example, here is an example curl command that requests for the MFA token via Resource Owner Password Grant:

```
curl --request POST \
  --url 'https://YOUR_DOMAIN/oauth/token' \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data grant_type=password \
  --data username=user@example.com \
  --data password=pwd \
  --data 'client_id=YOUR_CLIENT_ID' \
  --data client_secret=YOUR_CLIENT_SECRET \
  --data audience=https://YOUR_DOMAIN/mfa/ \
  --data 'scope=enroll'
```

2) The MFA token request in step 1 may require MFA challenge (with the 1st factor SMS). Complete the MFA challenge with SMS as usual, then the MFA token is issued as "access_token" in the response.
If you decode the issued access_token (e.g. using https://jwt.io), you should see the `"aud": "https://YOUR_DOMAIN/mfa/"` and `"scope": "enroll"` in the payload.

3) Use the MFA token obtained in step #2 to enrol the email factor as described in the document:
https://auth0.com/docs/secure/multi-factor-authentication/authenticate-using-ropg-flow-with-mfa/enroll-and-challenge-email-authenticators