[Due for payment 2025-11-07] Investigate users that can’t dismiss onboarding when 2FA is required to continue onboarding.

[trjExpensify]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.2.13-1
Reproducible in staging?: Y
Reproducible in production?: Y
If this was caught during regression testing, add the test name, ID and link from TestRail: No
Email or phone of affected tester (no customers): deets in slack thread
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: @trjExpensify
Slack conversation (hyperlinked to channel name): #quality

Action Performed:

These are the two paths to investigate deeper.

Domain 2FA required case

1. Verify a domain on Classic
2. Make 2FA required in Domains > Domain members
3. As a new user go to new.expensify.com and sign-up

Xero admin case

1. As adminA configure Xero on a workspace successfully
2. As adminA invite a new account as another admin
3. As adminB go to new.expensify.com and sign-in

Expected Result:

• 2FA modal appears first. Once completed, onboarding modal appears next if applicable to show.
• If the 2fa requirement is because of the domain restriction, amend to this part of the copy:

your company requires the use of…

• If the 2fa requirement is because of the Xero restriction, use the existing copy variation:

your Xero accounting connection requires the use of...

Actual Result:

• Onboarding modal is appearing overlaid a 2FA required blocking modal. The user can’t complete anything in the onboarding modal to continue.
• It appears as though the copy always mentions Xero as the reason 2FA is required, despite not being an admin nor connected to Xero

Workaround:

None - user is totally bricked by the onboarding modal.

Platforms:

Select the officially supported platforms where the issue was reproduced:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Platforms Tested:

On which of our officially supported platforms was this issue tested:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

FS and links in Slack thread.

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @trjExpensify

[melvin-bot]

Current assignee @trjExpensify is eligible for the Bug assigner, not assigning anyone new.

[jmusial]

I went through the Xero admin case today and this is the flow I got.

Flow seems fine except I'm not sure for onboarding modal appears next if applicable to show. .

No onboarding is shown to the user, is it applicable in this scenario ?

In Onyx Data I got

  "nvp_introSelected": {
    "choice": "newDotAdmin",
    "inviteType": "workspace",
    "isInviteOnboardingComplete": true,
    "previousChoices": ["newDotAdmin"],
    "reviewWorkspaceSettings": "2827135376791236",
    "submitExpense": "8413894285605431"
  },

Screen.Recording.2025-09-19.at.15.50.13.mov

[jmusial]

For the domain flow am I missing something?

But I get

when trying to create account with second user in new dot

[trjExpensify]

Ah yeah, I think that's applicable in the Xero invited admin case, as you've been invited to a workspace thus skip onboarding.

Maybe that's a red herring if the Xero copy is showing to the domain case? 🤔 I guess we just focus on the domain case for now and see if we can figure that out.

On your error, I haven't seen it before, but you're hitting this code block I think:

    public static function getActive($authToken)
    {
        $activePolicyID = NVPStore::get($authToken, NVP::ACTIVE_POLICY_ID);
        if ($activePolicyID === null) {
            // Closed accounts don't belong to any policy
            if (User_Store::get($authToken)->isClosed()) {
                return new Inaccessible('', Policy::FAKE_ID, []);
            }
            throw new ExpException('Can not get the active policy ID of the user', 400);
        }

        return self::getByID($authToken, $activePolicyID);
    }

Seems odd that you can't create an account after validation. Couple of other paths to maybe try to compare:

• Start on expensify.com > "Manage my team's expenses" > redirected to NewDot
• Invite a new account in Domains > Domain Members > as the invited account > go to expensify.com / new.expensify.com and start the sign-in.

[mountiny]

I do think that those FS sessions were not really Xero 2fa issue, but that we do not handle specifically the case where the domain itself requires 2FA.

I think we would need to look at these flows a bit more before you can dig into this @jmusial can you please prioritize other work/PRs? Thanks!

[trjExpensify]

Oh, I missed this. What do you want to do here next, Vit? We saw a fair few people impacted by this in the funnel.