How to find users with email MFA enabled and get count of MFA users?

FASupportBot

I need to query FusionAuth to:

Find all users who have email-based MFA (two-factor authentication) configured
Get an accurate count of these users without retrieving all user records
Determine when a user last used their MFA method

Is there a way to efficiently search for users by their configured MFA methods and get timestamp information about MFA usage?

FASupportBot

Finding Users with Email MFA Configured

You can search for users with email MFA using the query string pattern in either the Admin UI search bar or via the Search API:

twoFactor.methods.method:email

This follows the same pattern used for searching users by any MFA method.

Getting an Accurate Count Efficiently

To get a count without retrieving all user records, use the Search API with accurateTotal enabled and a minimal numberOfResults:

{
  "search": {
    "accurateTotal": true,
    "queryString": "twoFactor.methods.method:email",
    "numberOfResults": 1,
    "startRow": 0
  }
}

The response will include a total field containing the exact count of matching users.

Last-Used MFA Information

Unfortunately, FusionAuth does not store a timestamp for when a user last used their MFA method. However, each MFA method object includes a lastUsed boolean field at users[x].twoFactor.methods[x].lastUsed that indicates which method was most recently used by that user. This is a boolean flag rather than a timestamp, so you can identify which method was used last but not when it was used.