## TL;DR
Use a service account exempt from MFA, or complete the MFA step within its approval window. Browser automation cannot wait indefinitely for a human tap.

## Error
```text
Playwright timed out waiting for MFA approval on the admin login page
```

## Steps
1. Confirm the stall point: the Playwright trace shows the login reaching the MFA challenge and waiting. Expected: the MFA step identified.
2. Preferred fix: create a dedicated service account for the audit with MFA exempted by policy (IP allowlist, exempt group), scoped to read-only admin roles. Expected: logins no longer challenge.
3. If exemption is impossible, have a human complete the MFA promptly when the run starts, and set the session timeout longer than the approval window. Expected: the human-in-the-loop path works.
4. Re-run the login. Expected: the session establishes.

## When to use
- Playwright logins stall at MFA approval
- The admin login is browser-based
- The approval window expires before anyone taps

## When not to use
- An API exists for the data (use the API instead of the browser)
- The login fails before MFA (a credential problem)
- You can use SSO with a service identity (better than password plus MFA)

## Tool compatibility
Playwright against SaaS admin consoles.

### Variant phrasings
### MFA approval arrives after the timeout
Lengthen the timeout or shorten the approval path; the race is tunable.

### policy forbids MFA exemptions
Schedule the run when an approver is available, and alert them at run start.

## Why it happens
MFA is designed to need a human. Unattended browser automation plus human-gated MFA is a contradiction; one side has to give.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ElEdupdxbEf_e5vz6gSPLg