The MFA requirement for MCE SSO users is designed to mitigate risks associated with phishing and account takeovers for MCE users. By implementing Multi-Factor Authentication (MFA), the protection of user accounts that rely on SSO authentication is enhanced.

What’s Changing

Since February 1, 2022, Salesforce has required multi-factor authentication (MFA) as the baseline authentication requirement for all employee users accessing MCE environments via Single Sign-On (SSO). To ensure technical compliance ahead of the enforcement deadline, we are instituting validation of standards-based federation assurance signals — specifically Authentication Method Reference (AMR) and Authentication Context Class Reference (ACR) — passed to us by your Identity Provider during the authentication process.

Why Is Salesforce Making This Change

Salesforce aims to ensure all MCE user sessions are protected by MFA, regardless of the login method (Salesforce-managed vs. Federated SSO). Currently, MCE cannot independently verify if MFA was enforced for users logging in via Federated SSO, as authentication happens externally. The current federation assurance visibility across these environments is incomplete. Without these standards-based signals, Salesforce cannot confirm that second-factor protection is in place, thus creating a security gap. This initiative ensures that either the external IdP confirms MFA is active, or the user is guided to enroll in Salesforce-managed MFA.

Why This Matters (Threats Mitigated)

Multi-Factor Authentication (MFA) is one of the most effective defenses against common, high-impact security threats. By enforcing MFA for MCE SSO users, this requirement mitigates:

• Credential-Based Attacks: Preventing unauthorized access even if SSO credentials are compromised.

• Phishing: Neutralizing the effectiveness of stolen passwords by requiring a second, phishing-resistant factor.

• Session Hijacking: Reducing the impact of credential reuse by ensuring MFA signals are verified at the moment of authentication.

When Does This Change Take Effect

The enforcement starts January 29, 2027 and will be staggered over 5 days.  We recommend that users test their configurations well before the enforcement date.

Who’s Affected

The scope of this mandate includes all MCE users accessing environments via Federated SSO, excluding those who satisfy the following conditions:

• Every highly privileged MCE administrative profile using standard username and password login flows. Administrator roles include:

  • Marketing Cloud Administrator

  • Marketing Cloud Security Administrator

  • Email Studio Administrator

and,

• Every user with permissions that include - Administration | Account | Update Account and Security Settings. Refer Permissions for Setting Up Marketing Cloud Engagement

Note: Users with these privileges are subject to stricter Phishing-Resistant MFA requirements.

What to Expect

If you already use compliant MFA: If your enterprise IdP is configured to emit valid federation assurance signals (AMR/ACR), you will be considered compliant. You can continue using your SSO as your preferred authentication model without additional Salesforce-side enrollment.

If you are currently non-compliant: You may be required to take action, such as:

• Updating your IdP configuration to map and transmit the correct federation assurance values.

• Enabling supported MFA methods at the IdP level.

• Enrolling users in Salesforce-managed MFA if your IdP cannot be configured to meet the standards.