---
reference:
  json:
    - key: mfa_enrollment_error
      id: mfa_enrollment_error
      url: /reference/authkit/authentication-errors/mfa-enrollment-error
      title: mfa_enrollment
      properties:
        - key: code
          type: '"mfa_enrollment"'
          description: (authentication_errors.code)
        - key: message
          type: string
          description: (authentication_errors.message)
        - key: pending_authentication_token
          type: string
          description: (authentication_errors.pending_authentication_token)
        - key: user
          type: user
          description: (user.self)
originalPath: >-
  .tmp-workos-clone/packages/docs/content/reference/authkit/authentication-errors/mfa-enrollment-error.mdx
---

## MFA enrollment error

This error indicates that a user who is not enrolled into MFA attempted to authenticate in an environment where MFA is required. It includes a pending authentication token that should be used to authenticate the user once they enroll into MFA.

<CodeBlock
  title="MFA enrollment error"
  referenceId="mfa_enrollment_error"
  file="mfa-enrollment-error"
/>

When this error occurs, you’ll need to present an [MFA enrollment](/reference/authkit/mfa/enroll-auth-factor) UI to the user. Once the user has enrolled, present an MFA challenge UI to the user and authenticate them with their [TOTP code](/reference/authkit/authentication/totp) and the pending authentication token from this error.

MFA can be enabled via the [Authentication page](https://dashboard.workos.com/authentication) in the WorkOS dashboard.