We have a use case were we want certain users to be only able to use MFA by an authentication App whilst allowing other users to choose Email or authentication App. I have configured MFA to allow email for users for all users except those with the specified roles. The configuration restricts those users with the specified roles to Authentication App only. This is what we want.
However, the issue the user restricted to Authentication App only logs in. They see the Email OTP at that point with the option to set up their authentication App also being displayed.
As these users are restricted to using Authentication App only by the configuration, as can be validated by them initially setting up the Authentication App, I would expect that the only option they would see is the Authentication App one.
The issue is that they can opt on first login to use the Email OTP which allows them to login. However, if they logout and then log back in again they get the following screen that prevents them from logging in at all:
How do I configure the MFA options so that those users restricted, by roles, to using Authenticator App only just get the option to configure their Authentication App on first login? We also need all other users to be offered the option of Email OTP or Authentication App on first login. Although it would be acceptable for those users to be offered just Email OTP on first login and be able to use Authentication App thereafter if they configure their Authentication App via their user profile.
Just to be clear the issue is only what the user is being offered as a factor at initial login. The configuration we have works OK as long as restricted users select Authentication App as the factor at initial login. I just need to prevent the situation of them being able to select Email OTP on first login to prevent issues with their future logins.
