Users with MFA but multifactor[] is Missing

Last Updated: Sep 10, 2025

Overview

The user profile has multifactor[] as an empty array object even when email MFA is enrolled.

Applies To

Multi-Factor Authentication (MFA)

Solution

When email/biometric is the only enrolled factor, the user is still allowed to enrol in another factor. Email is generally enrolled implicitly (by verifying the user's email address) and is not considered a secure factor.

The 'multifactor' property is cleared when only email enrollment is detected. It's worth noting that manually deleting users' MFA factors while email is still part of the enrolled MFA will reset 'multifactor'.