> ## Documentation Index
> Fetch the complete documentation index at: https://auth0-chore-management-api-autoupdate.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Explore Auth0 Rules use cases for passwordless connections, from enforcing MFA on first sign-in to enriching user profiles with external API data.

# Sample Use Cases - Rules with Passwordless Authentication

<Warning>
  The End of Life (EOL) date of Rules and Hooks will be **November 18, 2026**, and they are no longer available to new tenants created as of **October 16, 2023**. Existing tenants with active Hooks will retain Hooks product access through end of life.

  We highly recommend that you use Actions to extend Auth0. With Actions, you have access to rich type information, inline documentation, and public `npm` packages, and can connect external integrations that enhance your overall extensibility experience. To learn more about what Actions offer, read [Understand How Auth0 Actions Work](/docs/customize/actions/actions-overview).

  To help with your migration, we offer guides that will help you [migrate from Rules to Actions](/docs/customize/actions/migrate/migrate-from-rules-to-actions) and [migrate from Hooks to Actions](/docs/customize/actions/migrate/migrate-from-hooks-to-actions). We also have a dedicated [Move to Actions](https://auth0.com/extensibility/movetoactions) page that highlights feature comparisons, [an Actions demo](https://www.youtube.com/watch?v=UesFSY1klrI), and other resources to help you on your migration journey.

  To read more about the Rules and Hooks deprecation, read our blog post: [Preparing for Rules and Hooks End of Life](https://auth0.com/blog/preparing-for-rules-and-hooks-end-of-life/).
</Warning>

With [rules](/docs/customize/rules), you can handle more complicated cases than is possible with [passwordless connections](/docs/authenticate/passwordless) alone. For instance, you can add extra precautions to further ensure possession of an email address or device.

## Require Multi-factor Authentication for users who are outside the corporate network

Let's say you want to require [multi-factor authentication (MFA)](/docs/secure/multi-factor-authentication) for any users who are accessing the application using a <Tooltip tip="Passwordless: Form of authentication that does not rely on a password as the first factor." cta="View Glossary" href="/docs/glossary?term=passwordless">passwordless</Tooltip> connection from outside your corporate network.

Using a rule, you can check whether a user is authenticating using a passwordless method (`sms`, `email`) and if their session IP falls outside of the designated corporate network, prompt them for a second authentication factor.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  You could also trigger this rule based on other criteria, such as whether the current IP matches the user's IP allowlist or whether geolocating the user reveals they are in a different country from the one listed in their user profile.
</Callout>

To do this, you would [create the following rule](/docs/customize/rules/create-rules):

```javascript lines theme={null}
function(user, context, callback) {
  const ipaddr = require('ipaddr.js');
  const corp_network = "192.168.1.134/26";
  const current_ip = ipaddr.parse(context.request.ip);
  // is auth method passwordless and IP outside corp network?
  const passwordlessOutside = context.authentication.methods.find(
    (method) => (
      ((method.name === 'sms') || (method.name === 'email')) && 
      (!current_ip.match(ipaddr.parseCIDR(corp_network)))
    )
  );

  // if yes, then require MFA
  if (passwordlessOutside) {
    context.multifactor = {
      provider: 'any',
      allowRememberBrowser: false
    };
  }
  callback(null, user, context);
}
```