diff --git a/access_groups.tf b/access_groups.tf
index b5fbd82..484925b 100644
--- a/access_groups.tf
+++ b/access_groups.tf
@@ -33,8 +33,10 @@ resource "cloudflare_zero_trust_access_policy" "policies" {
   require = concat(
     try(each.value.require_mfa, false) ? [{
       any_valid_service_token = false
-      auth_method             = "mfa"
-    }] : [],
+      auth_method = {
+      type = "mfa"
+    }
+  }] : [],
 
   try(each.value.require_country, false) == true ? [{
     group = {