Multi-Factor Authentication (MFA) Enforcement Roadmap

Per the Salesforce Trust and Compliance Documentation, Salesforce customers are contractually required to use multi-factor authentication (MFA) when accessing Salesforce products, whether by direct logins or single sign-on (SSO). This requirement went into effect on February 1, 2022. To help customers satisfy the MFA requirement, Salesforce automatically enabled and enforced MFA for users who log in directly with a username and password. These actions were carried out on a product-by-product basis between 2021 and 2024. The Salesforce program to drive MFA adoption concluded with the Summer '24 release. This roadmap is complete and closed to further updates.

For full details about the contractual MFA requirement, see the Salesforce MFA FAQ.

MFA Enforcement Schedule

See also:

• MFA for Salesforce customer site for MFA help and resources

*  MFA enforcement for products built on the Salesforce Platform

Thanks to the partnership of our customers, the program to automatically enable MFA for products built on the Salesforce Platform has resulted in a high rate of MFA adoption across Salesforce orgs. Because of this success, and wanting to be respectful of our customers’ valuable time and resources, we have shifted to a non-compliance notification model instead of technically enforcing MFA for production orgs. For more information, see Salesforce Admins Get In-App Reminders If MFA is Turned Off in the Salesforce Summer '24 Release Notes.