Skip to main content
Use email as a (MFA) factor to provide users a way to perform MFA when they don’t have their primary factor available (e.g. they don’t have their device to receive an SMS or push notification).

Availability varies by login implementation

The login implementation you use affects whether this feature is available. To learn more, read Universal Login vs. Classic Login.
Email is not true MFA because it does not represent a different factor than the password. It does not represent something I have or something I am, but rather just something I know (the email password). It is also weaker than other factors in that it’s only as secure as the email itself (for example, encrypted end-to-end). Users do not need to explicitly enroll with email MFA. They can use it when they have a verified email. This happens when they:
  • Complete the email verification flow which updates the email_verified field using the .
  • Log in with a connection that provides verified emails (such as Google).
You can only enable email as an MFA factor if there is already another factor enabled. Once Email MFA is enabled, users will be prompted to complete MFA with another enabled factor. If they select Try another method, and then pick Email, they will be sent an email with a one-time code that they will need to enter to complete the authentication flow.

​
Configure email notifications

You can explicitly enroll email for MFA using the MFA API. If users have a verified email and one or more explicitly enrolled emails, they can choose to select which email they want to use to complete MFA when logging-in using .
  1. Go to Dashboard > Security > Multi-factor Auth and enable the Email toggle. You will only be able to enable it if there is another factor enabled.
  2. Auth0 provides a test email provider but it only allows a limited amount of emails, so you should configure your own email provider. To learn more, read Configure External SMTP Email Providers.

​
Configure OTP settings

Customers are responsible for any diminishment in security posture resulting from a change to: (i) the Code Expiration Time or “Remember Me” Session Behavior lifespan to a time period longer than Okta’s standard recommended setup; or (ii) the OTP Length to a shorter character length than Okta’s standard recommended setup.
You can configure OTP code length and expiration time for the email factor. Settings apply to all users on your tenant.
  1. Navigate to Auth0 Dashboard > Security > Multi-Factor Auth and select Email.
  2. Configure the following:
    • Verification Code Length: Enter a value between 4 and 10 digits.
    • Verification Code Lifetime: Enter a value between 5 and 60 minutes.
  3. Select Save.

​
Learn more