Set default for requested 2FA method during login

[devcongit]

Hi,

we have users which have registered multiple 2FA methods (mail OTP and TOTP).

The 2FA method is validated during the default-authentication-mfa-validation stage. I can define, which device classes are allowed for 2FA, but not which should be the default for users.

Any idea?
Thanks

[Kofl]

It seems that Authentik remembers which authentication method the user last used and prompts them for that method on their next login.

[dewi-tik]

This is accurate. However, there is small bug at the moment that can cause a different MFA authenticator to be prompted. But this happens under limited circumstances and will be resolved in 2026.2.