Hello,
We are working on the MyMFA / My-Keys Premium enrollment lifecycle (Browser and Mobile App) and have two questions about the PIN.
Context
The PIN is set by the user at first enrollment. When a user removes their last MFA enrollment (Browser or Mobile App), their MyMFA / My-Keys Premium account appears to remain active. Our goal is for the user to be able to define a new PIN at their next enrollment.
Question 1: Resetting the MyMFA / My-Keys Premium account
Is there a widget or a function callable from Groovy that resets the user's MyMFA / My-Keys Premium account? Calling it when the last enrollment is removed would let the user define a new PIN at the next enrollment. If such a function exists, could you point us to the documentation or to a configuration example?
Question 2: Triggering on removal of the last enrollment
We would like to set up a policy that triggers in the following situation:
The user no longer has any Browser or Mobile App MFA enrollment, but their MyMFA / My-Keys Premium account is still active.
The user has just removed their last Browser or Mobile App MFA enrollment.
Is it possible to access or define such a trigger? For example, can an Object Policy or a Business Policy be scoped on the removal of an enrollment, and which object, event or attribute should it target (MyMFA account, identity, audit event)?
Additional information
Which policy type and stage would you recommend for this use case?
If a native mechanism already handles PIN reset when the last enrollment is removed, we would be glad to know about it.
Thank you in advance for your help.