Enable MFA for Direct Login

Important

Salesforce enforces MFA requirements in the summer of 2026. See these articles for more information and detailed rollout timelines.

• Prepare for MFA Enforcement for All Employee Users.
• Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins.

After MFA is enforced, this setting is turned on and can't be disabled.

To turn on MFA for all internal users in your org:

Note Make sure that admins and other privileged users are able to perform actions that require a high assurance-level of security. On the Session Settings page in Setup, make sure multi-factor authentication is in the High Assurance column.

Considerations:

• Before MFA enforcement, you can use the Multi-Factor Authentication for User Interface Logins permission (API name: PermissionsForceTwoFactor) to require MFA for specific users instead of turning it on for your whole org. However, the org-wide setting enforces MFA for all direct UI logins, even if users don't have the individual permission. When Salesforce enables the org-wide permission with MFA enforcement, users must use MFA even if they don't have this permission.

• This setting applies only to direct UI logins with a username and password. It doesn't affect logins through single sign-on (SSO). For MFA requirements when using SSO, including how admin and privileged user requirements interact with the AMR (Authentication Method Reference) attribute, see Use Salesforce MFA for SSO (Salesforce Orgs).