Implement a Custom MFA Process with Apex (Salesforce Orgs)

MFA requirements are changing in June 2026.

• Salesforce enforces MFA for direct UI and SSO logins for all employee users across production and sandbox orgs. See Prepare for MFA Enforcement for All Employee Users.
• Salesforce requires phishing-resistant MFA for users with the System Administrator profile or certain permissions. See Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins.

This example shows Apex code for MFA using Salesforce Authenticator as the verification method.

public void initVerification() {
// user will receive push notification on mobile device where the app is registered for MFA
 identifier = UserManagement.initVerificationMethod(Auth.VerificationMethod.SALESFORCE_AUTHENTICATOR);
}

public Auth.VerificationResult verifyVerification() {
// requiring identifier from the initVerification
// user will need to take the action on the mobile device where the app is registered for MFA
return UserManagement.verifyVerificationMethod(identifier, '' , Auth.VerificationMethod.SALESFORCE_AUTHENTICATOR);
}

Here’s an example for SMS.

public void initVerification() {
// user will receive code on their registered verified phone
 identifier = UserManagement.initVerificationMethod(Auth.VerificationMethod.SMS);
}

public Auth.VerificationResult verifyVerification() {
// requiring identifier from the initVerification
// the code will need to be entered in this method
return UserManagement.verifyVerificationMethod(identifier, code , Auth.VerificationMethod.SMS);
}

The next two examples show Apex code for MFA using only the verifyVerificationMethod for password and TOTP verifications.

public Auth.VerificationResult verifyVerification() {
// user will enter their password as a param in the verifyVerificationMethod for password verification method
return UserManagement.verifyVerificationMethod('', password , Auth.VerificationMethod.PASSWORD);
}

public Auth.VerificationResult verifyVerification() {
// user will enter their registered time-based one-time password (TOTP) code (token)
return UserManagement.verifyVerificationMethod('', code , Auth.VerificationMethod.TOTP);
}