> ## Documentation Index
> Fetch the complete documentation index at: https://docs.privy.io/llms.txt
> Use this file to discover all available pages before exploring further.

# When MFA is required

> Which wallet actions and resource updates require MFA with granular MFA.

With [granular MFA](https://docs.privy.io/authentication/user-authentication/mfa/granular/overview.md), a user completes MFA for wallet actions that match an `ALLOW_WITH_MFA` rule, and for changes to resources they own.

## Wallet actions

To authorize a request that matches an `ALLOW_WITH_MFA` rule in the wallet's policies, the user must:

1. Be enrolled in MFA. A user who hasn't enrolled must enroll first.
2. Have verified MFA within the cache duration.

Requests that match an `ALLOW` rule, and no `DENY` or `ALLOW_WITH_MFA` rule, go through without MFA, even for enrolled users, or else the request is denied by default.

* If the user is a member of a key quorum, their signature counts toward the threshold only with MFA. When approving an [intent](https://docs.privy.io/transaction-management/intents/sign-intents.md), include the MFA token with the approval. Each member can approve an intent only once.
* Authorization key signatures count toward the threshold without MFA.

## Resource updates

Changing a resource a user owns requires that user's MFA. Otherwise, a user could delete an `ALLOW_WITH_MFA` rule without MFA, then take the action it protected.

This applies to resources owned by a user, or by a key quorum with user members:

| Resource | Changes that require MFA |
| - | - |
| [Wallets](https://docs.privy.io/api-reference/wallets/update.md) | Updating the owner, additional signers, or policies, and attaching or detaching automations. |
| [Policies](https://docs.privy.io/api-reference/policies/update.md) | Updating or deleting the policy, and creating, updating, or deleting rules. |
| [Key quorums](https://docs.privy.io/api-reference/key-quorums/update.md) | Updating or deleting the key quorum. |
| [Condition sets](https://docs.privy.io/api-reference/condition-sets/update.md) | Updating or deleting the set, and adding, replacing, or deleting items. |
| [Wallet automations](https://docs.privy.io/api-reference/wallet-automations/update.md) | Updating or deleting the automation. |
| [Aggregations](https://docs.privy.io/api-reference/aggregations/delete.md) | Deleting the aggregation. |

These changes don't require MFA:

* **Creating a resource**, such as a new wallet or policy.
* **Changing a resource without an owner.** Your app's credentials control these resources directly.

Exporting a private key or seed phrase is a wallet action, not a resource change. It requires MFA only if a policy rule for `exportPrivateKey` or `exportSeedPhrase` uses `ALLOW_WITH_MFA`. See [granular MFA policies](https://docs.privy.io/controls/policies/example-policies/granular-mfa.md#require-mfa-for-wallet-export).