## TL;DR

Auth0 denies the login because an MFA rule (or action) requires enrollment the user has not completed, or the rule errors. Check the rule/action, enroll the test user in MFA, or adjust the rule's conditions.

## Error

```text
access_denied on login with an MFA rule
```

## Steps

1. Open the tenant logs for the failed login Expected: you see which rule/action denied it.
2. Enroll the user in MFA if the rule requires it Expected: the requirement is satisfied.
3. Or narrow the rule to the right users/clients Expected: it stops firing wrongly.
4. Retry the login Expected: it succeeds.

## When to use

- access_denied tied to an MFA rule
- The rule blocks unenrolled users or errors

## When not to use

- No MFA rule exists (then check actions and hooks too)
- The denial is for another reason (then read the log description)

## Tool compatibility

- Auth0 rules and actions
- Login flows

## Variant phrasings

### auth0 access_denied mfa rule

The rule requires MFA the user lacks. Enroll them or narrow the rule.

### mfa rule blocking login

Same: check tenant logs to see which rule fired.

## Why it happens

MFA rules are tenant-wide and easy to forget. Agents test with a fresh user who was never enrolled.

## Edge cases

- Rules run in order; an earlier rule can also be the culprit
- Test rule changes with a dedicated test user first

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_O9dkGHipomqh0KvKsPSA7Q