Enable MFA for Your Entire Salesforce Org

Important

As a safeguard against unauthorized account access, customers are contractually required to use MFA when logging in to Salesforce. To help users satisfy this requirement, the setting discussed in this topic is automatically enabled for production orgs. For full details about the MFA requirement, see the Salesforce Multi-Factor Authentication FAQ.

Before you begin:

• Determine if you have use cases that are exempt from the MFA requirement. For certain types of exempt users, you must manually exclude them from MFA enablement. To learn more, see Exclude Exempt Users from MFA for Salesforce Orgs.

To enable MFA for all internal users in your org:

Note Ensure that admins and other privileged users are able to perform actions that require a high assurance-level of security. On the Session Settings page in Setup, make sure Multi-Factor Authentication is in the High Assurance column.

Considerations:

• Users who have been assigned the Multi-Factor Authentication for User Interface Logins user permission experience no change when this org setting is enabled.

• The Waive Multi-Factor Authentication for Exempt Users user permission overrides this setting.

• If the Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org setting is disabled in a production org, all Salesforce admins see a warning prompt when working in Setup. These recurring prompts advise that the org is out of compliance with the MFA requirement and provide guidance on how to re-enable MFA.