Helle Medplum team. I noticed that even though mfaRequired can be set as

true

in the initial invite but there is no documentation on setting mfaRequired as

false

. I understand that even project admin may be not possible on server-scoped users but does same logic apply on project-scoped users as well? - Yong Lee

Hi Yong, as a project admin you should be able to disable mfa for a user that has it currently enabled. First you would set

mfaEnrolled

to false by calling the mfa reset endpoint - https://www.medplum.com/docs/auth/mfa#admin-mfa-reset Then you would manually disable the

mfaRequired

flag on the User

Hi Ian. My understanding of the current behavior of https://www.medplum.com/docs/auth/mfa#admin-mfa-reset is that once the MFA is reset, the user must re-enroll in MFA on their next login (if mfaRequired is set) or via the Security settings page. I actually did more testing and found out that PATCH /fhir/R4/User/{{user_id}} endpoint or medplum.patchResource('User', user.id!, [...]); allows you to change value of mfaRequired. My issue is resolved but I hope that there was better documentation on this behavior. - Yong

@Yong Lee , I agree the documentation is lacking. We will get it updated