Understanding Role Permissions for Disabling 2FA in FusionAuth

[wesley]

We are configuring accounts for our technical support team to allow them to disable 2FA in emergencies. According to the FusionAuth documentation, this should be possible with the user_support_manager role.

However, when attempting to disable 2FA, we are prompted to enter a One Time Password (OTP), and only the global_admin role seems able to complete the action.

Are we misconfiguring something, or could this behavior indicate a bug? We tested this on versions 1.45.1 and 1.46.0.

[wesley]

The behavior you are experiencing is working as designed.

Currently, only the global_admin role can bypass the OTP requirement to disable 2FA. While the user_support_manager role allows managing other user account aspects, it does not have the necessary permissions to bypass 2FA for removal.

Feature Request Option:
If this functionality is critical for your workflow, you could consider submitting a feature request to extend this capability to additional roles in a future release. Or review this issue and comment if it meets your needs.