MFA for Direct Salesforce Logins

Salesforce requires MFA for all internal users who access production orgs and sandboxes. Salesforce provides MFA functionality with several supported verification methods: passkeys (built-in authenticators and security keys), Salesforce Authenticator, and third-party authenticator apps such as Google Authenticator. For most users, you can control which verification methods are available. For internal users with privileged access, passkeys are the only supported method that satisfies the phishing-resistant MFA requirement.