Salesforce Login Deadlock: Lightning Login and Built-in Authenticator (Passkey) Conflict

This article answers the question: why does a Salesforce user see the error "you need both a higher access level and an identity verification method" when both Lightning Login and a Built-in Authenticator (passkey) are registered, and how can you fix it? Lightning Login establishes a Standard session that cannot satisfy the High Assurance requirement of the passkey, so login cannot complete.

How Each Method Works

The table below compares the session security level for each login method.

Why the Conflict Occurs

When both methods are present, Salesforce cannot determine which one satisfies the required session security level:

• Lightning Login cannot elevate the session to High Assurance.
• The passkey requires High Assurance to proceed.

The error message indicates the following:

1. The current method (Lightning Login) does not meet the required session security level.
2. The passkey is registered but unreachable because the session level requirement is not met first.

Root Cause

Lightning Login establishes a Standard-level session, which cannot satisfy the High Assurance requirement needed for passkey verification. This causes a deadlock where neither method alone can complete the login.

Why Lightning Login Gets Enabled

Lightning Login requires Allow Lightning Login to be enabled in Setup > Session Settings. Lightning Login is commonly observed to become active when a user registers Salesforce Authenticator (v2 or later), because the app supports Lightning Login enrollment. This is not the only path and may vary per user.

Option 1: Add Lightning Login to High Assurance

1. Navigate to Setup > Session Settings.
2. Under Session Security Levels, move Lightning Login to the High Assurance tier.
3. Save changes.

Option 2: Remove Lightning Login from the User

If no System Admin is able to log in because of this issue, a Salesforce Engineer can remove Lightning Login directly from the affected user's record:

1. Navigate to Setup > Users.
2. Open the affected user's detail page.
3. Click Cancel from the Lightning Login registration.

Verify the Fix

• Test login in an incognito/private browser window first to confirm the issue is resolved.
• For the regular browser to work correctly, clear the browser cache and cookies to refresh the session security level.