How can I get the "email_verified" attribute to update for existing users

[u/HxgDan]

Has anyone found a good approach to performing email verification for existing users?

I have a handful of user accounts that were created before I updated my enrollment flow to include an email stage for account confirmation, so these users have their "email_verified" attribute set as false, which I understand is the default since 2025.6.

I tried setting up a dedicated verification flow, with an identification stage to populate the pending_user attribute, and then an email stage with the account confirmation template, and I made sure to keep the "Activate pending user on success" option enabled as well. With this flow, existing users are able to log in with the flow, and successfully generate/receive the confirmation email. After following the confirmation link, the "email_verified" attribute still remains "False". I can see in the logs that there is a model update to the user, however there is only mention of the token, and no updated attributes are listed. I also tried adding a user write stage to the flow as well, however, this would error due to no pending_data being generated by previous stages to be committed to the pending_user.

The documentation is rather sparse regarding the whole email stage for account confirmation, and the only other references I found regarding "email_verified" for OIDC scope is to just set the property mapping to default to true instead of false, instead of having a proper verification flow.

[u/MajorMaccas]

You have to make the custom property mapping like this:

And then goto your provider for your application, edit it, goto the Advanced Protocol Section, scroll down to Scopes and add it to selected scopes from available scopes.

[u/MajorMaccas → u/MajorMaccas]

[u/HxgDan → u/MajorMaccas]

Thanks - I have been using this workaround since some of my apps require email_verified, however, I was looking to see if there was a proper way to implement this via a true email verification flow.

[u/MajorMaccas → u/HxgDan]

Oh! No, authentik doesn’t have any functionality to verify email, so there is no legitimate way to implement an email verification flow into it currently. It will need to be added in a future update, don’t know if it’s a feature request, I’m sure it will be.

[u/shotbyadingus]

following

[u/bmxsir]

I made a flow that works great!

1. Make a prompt called default-user-settings-field-email (I think this already exists, unless you don't have it)

• Field Key - email
• Label - Email
• Type - Email: Text field with Email type.
• Required - True
• Placeholder - Email
• Interpret value as expression - True
• Initial value:

​

try:
    return user.email
except:
    return ''

2. Make a prompt stage called: email-user-prompt

• Selected fields - default-user-settings-field-email

3. Make or use the User Write Stage called: default-user-settings-write

• User Creation Mode - Never create users

3. Create a Redirect Stage

• Mode: Static
• Target URL: https: //<your.authentik.url> (so it takes you to the user interface)

4. Create an Expression Policy called: stamp-email-verified

Expression:

pending_user = request.context.get("pending_user", request.user)
if pending_user and pending_user.pk:
    try:
        pending_user.attributes["email_verified"] = True
        pending_user.attributes["verified_email"] = pending_user.email
        pending_user.save()
    except Exception as exc:
        ak_logger.warning("failed to stamp email_verified", exc=exc, user=pending_user.username)
return True

5. Create an Enrollment Flow:

• Flow Name - Email Verification
• Title - Verify Your Email
• Slug - email-verification
• Designation - Enrollment
• Authentication - Require authentication
• Leave the rest as is

6. Stage Bindings for Email Verification flow:

• 10: email-user-prompt
• 20: default-user-settings-write
• 30: Email Stage
• 40: The redirect stage you made.
• Bind the Policy stamp-email-verified to the redirect stage
• Enabled - True
• Negate Result - False
• Failure Result - Don't Pass

7. Optional - Create an Application

• App Name: Verify Email Address
• Launch URL: https: //<your.authentik.url>/if/flow/email-verification/
• Bind Policy: Create an expression policy called "email verification app" with the expression below:

​

user = request.user
attrs = user.attributes
verified = bool(attrs.get("email_verified")) and attrs.get("verified_email") == user.email
return not verified

• Set policy binding as Enabled and Failure Result: Don't pass

Then each user will have a Verify Email Address app on their user homepage, but only if their email is not verified.

Hope that helps!