This behavior has been resolved and deployed to the production environment as of 7/1/26.
Summary:
When a user is is going through the registration process for a new account and sets their password they are logged in automatically without being prompted to setup MFA even if MFA is required in the instance This can happen when registering through Catalog, accepting a course invitation, or when setting up a user account from a registration email.
Expected behavior:
Instead if MFA is required in an instance, users who are registering new account should be required to set up MFA
Steps to Reproduce:
Prerequisites: An instance with MFA required, and two courses
When accepting registration:
- On the people page in the instance create a new user
- Check the new user’s notification messages for a registration email
- Use the link in the registration email to set up the account and note that MFA setup is not prompted and the user is logged in as soon as they create the account
- Log out then attempt to log back in and note that MFA is required
When accepting course invite:
- In one of the courses enroll a new user via email
- Check the notification messages for the user to find the course invitation email
- Use the invitation link to set up a new user account and note that MFA setup is not prompted and the user is logged in as soon as they create the account
- Log out then attempt to log back in and note that MFA is required
Catalog:
- In catalog create a listing linked to the second course and open the listing for registration
- Access the listing link in a browser session where you are not logged in to Catalog
- Select the option to enroll then to create a new account
- Fill out the required details then check the email entered for a registration link
- Use the registration link to set up the account and note that MFA setup is not prompted and the user is logged in as soon as they create the account
- Log out then attempt to log back in and note that MFA is required
