Extract the Count of Distinct MFA Device Types in Auth0

Extract the distinct Multi-Factor Authentication (MFA) types and their respective counts by performing a bulk user export and iterating through the user IDs with a custom script. The standard user profile and bulk exports only return the MFA provider rather than the specific device type, such as SMS, Email, and Time-based One-Time Password (TOTP). Administrators must use the Management API to aggregate this data and extract the total user count for specific MFA device types.

• Auth0
• Multi-Factor Authentication (MFA)
• Management API
• Bulk User Export

A Custom Script Extracts and Counts Distinct MFA Device Types

Retrieve the distinct MFA types and their respective counts by exporting the user base and querying the Management API for each user using these steps:

1. Perform a Bulk User Export with minimum identifiers (such as user_id) to gather all user IDs. Auth0 recommends using the Bulk User Export over the List Users API endpoint because the List Users method limits results to 1000 records: Performance recommendations.
2. Create a custom script to iterate through the exported user IDs.
3. Configure the script to call the Get a user's authentication methods endpoint for each user ID: Get a list of authentication methods.
4. Parse the JSON response from the endpoint to extract and count the type field (for example, totp, email, phone). Account for multiple items in the response if a user has multiple enrolled factors.

How does a custom script handle Management API rate limits during bulk operations?

Prevent failed requests when iterating over a large number of users by implementing rate limit handling in the custom script using the following guidelines:

• Review the Enterprise Rate Limit Configurations: Enterprise Rate Limits.
• Introduce a brief delay between each API call or implement an exponential backoff retry logic if a 429 Too Many Requests HTTP error occurs.
• Read the x-ratelimit-reset HTTP header in the response when receiving a 429 error. This header provides the exact Unix timestamp of when the rate limit window resets. Pause the script until this timestamp to safely resume sending requests: Predict when requests to a tenant will be rate limited.

NOTE: The Management API and the Authentication API operate on separate rate limit buckets. Hitting a 429 error on the Management API does not impact the ability of end-users to authenticate.