Require Multi-Factor Authentication (MFA) for All Direct UI Logins to Your Salesforce Org Setting Is Greyed Out When MFA Is Enforced

This article answers why the "Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org" setting is greyed out, and what MFA enforcement requires for Username/Password and SSO logins.

Why the Setting Is Greyed Out

When MFA is enforced at the org level, Salesforce greys out the setting. The enforcement applies to both Username/Password and SSO logins.

Requirements for Username/Password Logins

Users who authenticate with Username/Password must use a Salesforce-supported MFA verifier.

Requirements for SSO Logins

Users who authenticate through SSO must have the Identity Provider (IdP) send a compliant AMR/ACR signal. For details, see the article Prepare for MFA Enforcement for All Employee Users.