MFA for Direct Salesforce Logins

Salesforce requires MFA for all internal users who access production orgs and sandboxes. Salesforce provides MFA functionality with several supported verification methods: passkeys (built-in authenticators and security keys), Salesforce Authenticator, and third-party authenticator apps such as Google Authenticator. For most users, you can control which verification methods are available. For internal users with privileged access, passkeys are the only supported method that satisfies the phishing-resistant MFA requirement.

• Enable MFA for Direct Login
  Turn on multi-factor authentication (MFA) for everyone in your org with a single setting. When MFA is enabled, all internal users logging in directly with their username and password must also provide an identity verification method, such as an authenticator app or security key.
• MFA Verification Methods for Direct Salesforce Login
  The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce MFA functionality supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. You can control which methods are available to your users.
• Configure the MFA Verification Methods Available to Your Users for Salesforce Orgs
  Salesforce supports four identity verification methods for multi-factor authentication (MFA) and device activation: built-in authenticators, physical security keys, Salesforce Authenticator, and third-party authenticator apps. As a security best practice, require users to use phishing-resistant methods: built-in authenticators or security keys. In orgs created before Summer ’25, Salesforce Authenticator and third-party apps are automatically available to users, but a Salesforce admin must enable the options to use passkeys (built-in authenticators and physical security keys). In orgs created in Summer ’25 and later, all verification methods are allowed by default. For external users only, you can allow the use of one-time passcodes delivered via SMS text messages.
• Decide How Users Select a Verification Method During MFA Registration for Salesforce Orgs
  Optimize how users register identity verification methods for multi-factor authentication (MFA) and device activation, based on the methods you want to prioritize. If you’re supporting multiple verification methods, you can start with a list of all options for users to choose from. Or, if you want to prioritize built-in authenticators, you can present that option first.
• Help Users Register MFA Verification Methods for Direct Login
  Multi-factor authentication (MFA) is required to access production and sandbox orgs. To log in, users must have at least one registered identity verification method that they provide in addition to their username and password. If they haven’t set up a verification method, they’re prompted to register one for MFA when they log in. The registration process connects a verification method to the user’s Salesforce account. Each user must complete this step themselves — Salesforce admins can’t do it for them. But you can head off confusion and support tickets but making sure your users understand what they must do.
• Enable MFA for External Experience Cloud Site Users (or Specific Internal Users)
  Salesforce doesn’t require multi-factor authentication (MFA) for external users but you can certainly include this class of users in your MFA implementation. To enable MFA for external users who log in directly to your company’s Experience Cloud sites, employee communities, or other types of community portals, apply the Multi-Factor Authentication for User Interface Logins user permission. You can also use the MFA user permission to enable MFA for specific internal users. When MFA is turned on, users logging in directly with their username and password must also provide an identity verification method such as an authenticator app or security key.
• Complete MFA Challenges for Automation Users
  Salesforce requires multi-factor authentication (MFA) for all UI logins, including logins from automation users. For automation use cases such as Robotic Process Automation (RPA), you can programmatically complete MFA using third-party authenticator apps that generate time-based one-time passwords (TOTPs).
• Exclude Exempt Users from MFA for Salesforce Orgs
  Some use cases are exempt from the multi-factor authentication (MFA) requirement. When you or Salesforce enables MFA for your users, many of these use cases — including integration user access via the API — are automatically excluded. But there are a few cases that customers must exclude on their own. If any of these situations apply to your environment, use the Waive Multi-Factor Authentication for Exempt Users user permission.
• Set MFA Login Requirements for API Access (Salesforce Orgs)
  Multi-factor authentication isn’t required for system integration login types via the API. But you can add extra protection for API access with the Multi-Factor Authentication for API Logins permission. With this permission enabled, users are required to complete a second authentication challenge to access Salesforce APIs. API access includes the use of client applications such as the Data Loader and connected apps.
• Implement a Custom MFA Process with Apex (Salesforce Orgs)
  To implement your own multi-factor authentication (MFA) process, use Apex methods under the System.UserManagement class. The methods come as a pair for the Salesforce Authenticator and phone (SMS) identity verification methods — one to initiate a verification service, and one to complete the verification service. For password or time-based one-time password (TOTP) verification methods, you can use the second method alone to provide a complete verification service. Use of SMS for MFA is supported only for external users accessing your company’s Experience Cloud sites, employee communities, and other types of community portals.