Experience Cloud Passkey Prompts

Internal Users

Internal users access your Salesforce org directly, but can also access Experience Cloud sites. Internal users have one of these licenses.

• Standard Salesforce licenses
• Chatter Only (Chatter Plus)

If an internal user logs in to an Experience Cloud site, Salesforce requires MFA. If the user doesn't have a registered MFA method, they see a prompt to create a passkey.

Note Salesforce requires users with privileged permissions to use a passkey for phishing-resistant MFA. Non-privileged users can choose to either set up a passkey or register another verification method. See Recognize Passkey Creation Prompt Behavior.

External Users

External users, such as customers and partners, access Salesforce only via Experience Cloud sites. They don't access your Salesforce org directly. External users have one of these licenses.

• Experience Cloud licenses
• Chatter External
• Chatter Free

While Salesforce doesn't require MFA for external users, you can choose to require MFA by assigning the “Multi-Factor Authentication for User Interface Logins" user permission. If an external user has this permission, they can see a prompt to register a passkey. If they don't want to register a passkey, they can click Choose Another Verification Method.

Currently, external Experience Cloud can't disconnect passkeys from their user account by themselves. To disconnect an external user's passkey, use the UserManagement.deregisterVerificationMethod(userId, method) Apex method. This method disconnects only one passkey at a time. For example, if a user has 3 passkeys, this method disconnects only one passkey. To disconnect the rest, use the same method until all passkeys are disconnected.

Identify a User's License Type

To identify whether a user is internal or external, review the user’s license.

1. From Setup, in the Quick Find box, find and select Users.
2. Click the user’s name, and then review the user’s license.