Loading
Identify Your Users and Manage Access
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Implement Multi-Factor Authentication for Salesforce Orgs

            You are here:

            1. Salesforce Help
            2. Docs
            3. Identify Your Users and Manage Access

            Implement Multi-Factor Authentication for Salesforce Orgs

            As a safeguard against unauthorized account access, customers are contractually required to use multi-factor authentication (MFA) when accessing Salesforce products — either directly with a username and password or via single sign-on (SSO). To help users satisfy this requirement, MFA is a default part of the direct login experience for production orgs. It’s quick and easy to enable MFA for direct logins to other environments such as trial or developer orgs. For single sign-on (SSO) logins, you can implement the free MFA functionality provided by Salesforce or use your SSO provider’s MFA service.

            Required Editions

            Available in: both Salesforce Classic and Lightning Experience
            Available in: all editions
            • Enable MFA for Direct User Logins to Salesforce Orgs
              Users are contractually required to use multi-factor authentication (MFA) when logging in to Salesforce. To help customers satisfy this requirement, MFA is automatically enabled for direct logins to production orgs. It’s a simple process to turn on MFA for direct logins to other environments such as trial or developer orgs, or for your production org if you’re not using MFA yet. Some uses cases are exempt from the MFA requirement, and some types of exempt users must be manually excluded from receiving MFA challenges when logging in.
            • Turn On MFA for Single Sign-On (SSO) to Salesforce Orgs
              Customers are contractually required to use multi-factor authentication (MFA) when accessing Salesforce. If your users log in to your Salesforce org via single sign-on (SSO), you have the choice of turning on your SSO provider’s MFA service or implementing the free MFA functionality provided by Salesforce.
            • Set MFA Login Requirements for API Access (Salesforce Orgs)
              Multi-factor authentication isn’t contractually required for system integration login types via the API. But you can add extra protection for API access with the Multi-Factor Authentication for API Logins permission. With this permission enabled, users are required to complete a second authentication challenge to access Salesforce APIs. API access includes the use of client applications such as the Data Loader and connected apps.
            • Implement a Custom MFA Process with Apex (Salesforce Orgs)
              To implement your own multi-factor authentication (MFA) process, use Apex methods under the System.UserManagement class. The methods come as a pair for the Salesforce Authenticator and phone (SMS) identity verification methods — one to initiate a verification service, and one to complete the verification service. For password or time-based one-time password (TOTP) verification methods, you can use the second method alone to provide a complete verification service. Use of SMS for MFA is supported only for external users accessing your company’s Experience Cloud sites, employee communities, and other types of community portals.

            See Also

             
            Loading
            Salesforce Help | Article