MFA for Direct Salesforce Logins

Salesforce requires MFA for all internal users who access production orgs and sandboxes. Salesforce provides MFA functionality with several supported verification methods: passkeys (built-in authenticators and security keys), Salesforce Authenticator, and third-party authenticator apps such as Google Authenticator. For most users, you can control which verification methods are available. For internal users with privileged access, passkeys are the only supported method that satisfies the phishing-resistant MFA requirement.

• Enable MFA for Direct Login
  Turn on multi-factor authentication (MFA) for everyone in your org with a single setting. When MFA is enabled, all internal users logging in directly with their username and password must also provide an identity verification method, such as an authenticator app or security key.
• MFA Verification Methods for Direct Salesforce Login
  The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce MFA functionality supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. You can control which methods are available to your users.
• Configure the MFA Verification Methods Available to Your Users for Salesforce Orgs
  Salesforce supports four identity verification methods for multi-factor authentication (MFA) and device activation: built-in authenticators, physical security keys, Salesforce Authenticator, and third-party authenticator apps. As a security best practice, require users to use phishing-resistant methods: built-in authenticators or security keys. In orgs created before Summer ’25, Salesforce Authenticator and third-party apps are automatically available to users, but a Salesforce admin must enable the options to use passkeys (built-in authenticators and physical security keys). In orgs created in Summer ’25 and later, all verification methods are allowed by default. For external users only, you can allow the use of one-time passcodes delivered via SMS text messages.
• Verification Method Selection During MFA Registration
  With MFA enforcement, Salesforce prompts employee users who don't have a registered verification method to set up passkeys, also known as built-in authenticators. Salesforce requires passkeys for direct login for users with privileged permissions. Users who don't have these privileged permissions (non-privileged users) can choose to set up another verification method for direct login, such as Salesforce Authenticator. But passkeys are still the first option that all users see in the MFA registration flow, regardless of their permissions.
• Help Users Register MFA Verification Methods for Direct Login
  Multi-factor authentication (MFA) is required to access production and sandbox orgs. To log in, users must have at least one registered identity verification method that they provide in addition to their username and password. If they haven’t set up a verification method, they’re prompted to register one for MFA when they log in. The registration process connects a verification method to the user’s Salesforce account. Each user must complete this step themselves — Salesforce admins can’t do it for them. But you can head off confusion and support tickets but making sure your users understand what they must do.
• Enable MFA for External Experience Cloud Site Users (or Specific Internal Users)
  Salesforce doesn’t require multi-factor authentication (MFA) for external users but you can certainly include this class of users in your MFA implementation. To enable MFA for external users who log in directly to your company’s Experience Cloud sites, employee communities, or other types of community portals, apply the Multi-Factor Authentication for User Interface Logins user permission. You can also use the MFA user permission to enable MFA for specific internal users. When MFA is turned on, users logging in directly with their username and password must also provide an identity verification method such as an authenticator app or security key.
• Complete MFA Challenges for Automation Users
  Salesforce requires multi-factor authentication (MFA) for all UI logins, including logins from automation users. For automation use cases such as Robotic Process Automation (RPA), you can programmatically complete MFA using third-party authenticator apps that generate time-based one-time passwords (TOTPs).
• Exclude Exempt Users from MFA for Salesforce Orgs
  The Waive Multi-Factor Authentication for Exempt Users user permission previously allowed you to exempt specific users from MFA for use cases such as automation. After Salesforce enforces MFA requirements in your org, this permission no longer automatically exempts users from MFA. To restore this exemption for valid use cases, you must contact Salesforce Customer Support.
• Multi-Factor Authentication for API Access
  Salesforce doesn't require multi-factor authentication (MFA) for integration login types via the API. But you can add extra protection for API access with the Multi-Factor Authentication for API Logins permission. With this permission, you require users to complete a second authentication challenge to access Salesforce APIs. API access includes the use of client apps such as the Data Loader and connected apps.
• Implement a Custom MFA Process with Apex (Salesforce Orgs)
  To implement your own multi-factor authentication (MFA) process, use Apex methods under the System.UserManagement class. The methods come as a pair for the Salesforce Authenticator and phone (SMS) identity verification methods — one to initiate a verification service, and one to complete the verification service. For password or time-based one-time password (TOTP) verification methods, you can use the second method alone to provide a complete verification service. Use of SMS for MFA is supported only for external users accessing your company’s Experience Cloud sites, employee communities, and other types of community portals.