Unable to Deregister SALESFORCE_AUTHENTICATOR MFA via Apex (Works in Dev Console but Not in App Flow)

Hi everyone,

I’m currently facing an issue when trying to remove MFA methods in Salesforce using Apex.

Salesforce provides the following function to deregister a verification method:

public static void deregisterVerificationMethod(Id userId, Auth.VerificationMethod method)

I’m using this method to remove two types of MFA:

• Auth.VerificationMethod.TOTP
• Auth.VerificationMethod.SALESFORCE_AUTHENTICATOR

Here’s the issue:

• When I run the code through my application flow (after approving an app form), it successfully disables TOTP.
• However, it does not disable SALESFORCE_AUTHENTICATOR, even though the method executes without any errors. Notably, if the verification method has already been deregistered, Salesforce correctly throws an exception stating that the method has already been removed. 
• The user who approves the app form has sufficient permissions and is able to disable both methods directly from the Salesforce UI (via the user profile page).
• Additionally, when I test the same Apex code directly in the Developer Console, both TOTP and SALESFORCE_AUTHENTICATOR are successfully removed.

So the strange part is:

• It works in Developer Console.
• It partially works (only TOTP) in my application flow.

Has anyone experienced a similar issue? Could this be related to execution context, user session type, or some internal Salesforce restriction with Salesforce Authenticator?

Please let me know if anyone has experienced this or knows of a better way to solve it.

Thanks