Permission to disable tfa

Help
1

In my custom FE admin system, I am trying to setup a way for a lower level admin role (lower than superadmin) to disable another user’s tfa, if needed (for example someone has lost their phone or auth app). I have created a custom endpoint that posts to ‘/users/[id]/tfa/disable’ and this works, but only if I’m superadmin. Otherwise I get permission error. What collection do I need to give permission to for this? It is obviously not directus_users since admins already have update permission to that. Or is this something that can never have an access policy?

I am the only superadmin for the system and I’d rather not have tfa issues on my support table :wink:

2

There’s no built-in way for other users to force reset or override the TFA token. This is currently done on purpose as doing so opens up a large security can of worms. That doesn’t negate your ask though! I’ve jotted down your message as a feature request so we can address this in a better way in the future :slight_smile: Thanks!