Auth0: Conditional multi-factor rule removes permissions from JWT

Question

For some reason enabling MFA (sms code) removes permissions from JWT (access token). I have checked the setup a few times and all seems to be OK, but for the same account without MFA a permissions presented in JWT, with enabled MFA - no. (I do not using webauth)

I have found this 3 topics:

• Access token is missing permissions when using MFA
• Permissions not included in access token for MFA flow
• Conditional multi-factor rule removes permissions from JWT

And I think we have the same kind of problem (there is no answer by links).

Code of rule looks like this:

    const userEnrolledFactors = user.multifactor || [];
    const canPromptMfa = userEnrolledFactors.length > 0;

    if(canPromptMfa) {
      context.multifactor = {
        provider: "any",
        allowRememberBrowser: false,
      };
    }

Answer 1

Issue was on Auth0 side. And now it have been fixed on their side