MFA link in profile nav not showing for super editing other members

[robinsowell]

7.3.13 I'm logged in as a superadmin, MFA is enabled. I go to my profile page, link is in subnav and I can edit my setting:

I go to edit another user- tried both another superadmin and a non-super- and the access just isn't there:

[intoeetive]

This is intended behavior.

You are not allowed to manage MFA settings for someone else, because you would need a device, and that needs to be THEIR device. So this link is only available for the user that is logged in.

@robinsowell LMK if there are extra undesired consequences involved otherwise I'll close this

[robinsowell]

I've had 2 users so far not be able to disable it for a legit user who had somehow locked themself out. I'm actually going to test and make sure there isn't a problem using tokens to get back in. But regardless, folks will get locked out and an admin may want to turn it off for them so they can get back in.

In both cases, I had them edit the setting for the member directly in the database, which is never a great option.

Maybe leave the link, display a message if it's set to off that it can only be enabled by the 'Person in the Profile' but allow them to turn it off if it's already set to on. That or don't show the link for an admin not the user in the profile unless it's already set to on. But inconsistent behavior tends to confuse people- so I'd go with showing the link regardless.

[chunkitdesign]

I completely agree with Robin. I was also facing a similar issue and had to disable the original account of my coworker. Eventually, I created a new account for her. Although I was able to fix the problem by manipulating the database, it was not an ideal solution, especially since my coworkers were not familiar with MFA.

[Opaismoe]

I agree with Robin as well. We would really like an option to disable MFA per user, so a user who is locked out of their own account would be able to get back in with the help of a super admin.

As much as I'd like to trust the user not to lose their device and/or authenticator in combination with their recovery key, I'm not confident this will never happen.