Salesforce has sent multiple emails to admins over the past month regarding changes to Multi-Factor Authentication. There are two major changes that will impact all Salesforce users: 1) Multi-Factor Authentication is now REQUIRED for ALL USERS. 2) System Administrators and users with privileged access will be required to enroll in a "Phishing-Resistant" Multi-Factor Authentication methods. We will talk through these changes and what actions you need to take below. For full details (and a quick video summary), please refer to the official Help.Salesforce.com article.

What is Changing:

Starting July 1, 2026 for Production sites, and June 22nd for Sandboxes, Salesforce is making two key changes:

• For standard users, Salesforce will require MFA for all UI logins. This includes closing the loophole that previously existed by applying the Waive Multi-Factor Authentication for Exempt Users permission to users–when Salesforce makes these changes, any user that has this permission will be required to use an MFA method.
• For privileged users/System Administrators, Salesforce will require a stronger form of MFA called Phishing-Resistant MFA. Existing forms of MFA such as Mobile Authenticator apps or One-Time TOTP codes will NO LONGER WORK FOR ADMINISTRATORS.

Who is Affected?

All users who access the Salesforce UI are affected by, at a minimum, the standard MFA requirement. Essentially, all of your licensed Salesforce users.

A smaller group of users, called "privileged users", must comply with the stronger Phishing-Resistant MFA requirement. These are users with any of the following:

• The System Administrator profile
• View All Data or Modify All Data system permissions
• Author Apex or Customize Application system permissions

Salesforce Community/Experience Cloud users, and API/Integration Only users are not affected by these changes.

What MFA Methods are Supported?

For Standard/Non privileged/Admin users, Standard MFA options include push notifications from the Salesforce Authenticator mobile app or other (Microsoft/Google) authenticator apps, TOTP codes, built-in authenticators like Windows Hello or Touch ID, physical hardware keys like Yubikeys, eligible single sign-on configurations, and FIDO2-compliant passkeys stored in a password manager. Most of your users should already be enrolled in some level of Multi-Factor Authentication, if your users are not currently using MFA to login to Salesforce, please have them enroll. The Salesforce Authenticator app provides the most frictionless experience for most people.

Phishing-Resistant MFA is a subset of these methods, and it is worth noting that the Salesforce Authenticator mobile app is not included. Supported options for privileged/Admin users include:

• Built-in physical authenticators (like Windows Hello or Touch ID)
• Physical hardware keys (like Yubikeys, available for $29 to $60 at retailers like Best Buy or Amazon)
• Single sign-on configurations that send specific AMR or ACR values to Salesforce
• FIDO2-compliant passkeys stored in a password manager, used with passwordless login

A note for organizations using Single Sign-On (SSO)

If your organization logs into Salesforce through a Single Sign-On provider such as Okta, Google Workspace, or Microsoft Entra ID, SSO alone does not satisfy the new Phishing-Resistant MFA requirement. Salesforce will inspect the authentication signals your identity provider passes along at login, specifically values called AMR (Authentication Methods Reference) and ACR (Authentication Context Class Reference). If those signals do not confirm that a phishing-resistant method was used, Salesforce will block privileged users from logging in or prompt them to enroll a Salesforce-side method on the spot.

If your organization uses SSO, you will need to work with your SSO administrator to confirm that your identity provider is configured to pass the correct AMR/ACR values to Salesforce. Please refer to the Salesforce Help article on AMR/ACR values for the full list of accepted signals and configuration guidance.

Important notice for Microsoft Entra ID (Azure AD) users: Microsoft Entra ID is currently unable to satisfy the Phishing-Resistant MFA requirements. If your organization uses Entra as your SSO provider, you should open a support ticket with Salesforce Support as soon as possible. Salesforce is provisioning 90-day deferrals to organizations in this situation. For additional context on the Entra/Salesforce SSO configuration, you can also reference Microsoft's documentation here. Please do not wait on this one; reach out to us and we can help you navigate the support ticket process.

What do you need to do?

For most regular users already enrolled in MFA, nothing changes and they should not experience any issues. The changes that require action are primarily for your org's administrator(s) and any other privileged users, or standard users not already enrolled in MFA.

If your admins have been relying on push notifications, or six-digit TOTP codes generated by an authenticator app, they will need to register a Phishing-Resistant MFA method before July 1 to maintain access to your org. Beginning on July 1, Salesforce will block users from logging in until they have registered the appropriate MFA method.

We also recommend checking whether any integrations your org relies on may be affected, depending on how those integrations are configured. If any integrations are configured with a UI login based license, MFA will apply to those users as well. Persistant integrations such as Formassembly or Dataloader.io should not break, but should access ever be revoked, MFA will be required to re-authentiate the integration user.

Section 1: For Administrators - Enabling Phishing Resistant MFA methods in your org

Before any users in your org can register a phishing-resistant MFA method, an administrator must enable the appropriate verification options in Salesforce Setup. This is a one-time configuration step (repeat for each sandbox as well).

1. Login to Salesforce and click the Setup gear icon in the top right corner, then select Setup.
2. In the Quick Find search box, type Identity Verification and select Identity Verification from the results.
3. On the Identity Verification page, enable the following options by checking each box:
   • Let users verify their identity with a built-in authenticator (such as Touch ID or Windows Hello)
   • Let users verify their identity with a physical security key (such as a Yubikey)
   • Allow passwordless login with passkeys
   • Require/Show all permitted MFA options

4. Click Save. Your admins can now register phishing-resistant MFA methods on their own accounts.

Section 2: For Users - Registering a Phishing Resistant MFA method

Once your administrator has enabled the appropriate settings, you can register your phishing-resistant MFA method directly from your Salesforce user settings.

1. Log in to Salesforce. Click your user avatar in the top right corner and select Settings.
2. In the left-hand menu, click Advanced User Details.
3. Scroll to the Built-In Authenticators row and click Add.

1. Salesforce will prompt you to verify your identity using an existing MFA method before proceeding.
2. After verifying, your browser will trigger your device's built-in authenticator based on what's available to you (Touch/Face ID, Passkeys through a password manager, iCloud/Google password Manager Keychains). Follow the on-screen prompts to complete registration.
   1. If you would like to use a physical hardware key, follow the prompts to connect and authenticate your hardware key.

Salesforce prompt to register a passkey for phishing-resistant MFA. Clicking "Register Passkey" will prompt the user with what's available to them based on their device.

If you do not have a device installed password manager app or other authentication method, users will be presented with this screen to scan the QR code and connect authentication to their device for passkey registration, or to use a physical security key.

1. Once registration is complete, your key will appear under the Security Key row. Your method is now active.
2. Verify your method is active by logging out and back into Salesforce. If you are prompted with your new registration method, you have completed Phishing-Resistant MFA registration correctly.

Take Action Now

The July 1, 2026 enforcement date for production orgs is fast approaching, and once Salesforce begins enforcing these requirements, affected users will be blocked from logging in until a compliant MFA method is registered. There is no grace period once enforcement reaches your org. We strongly encourage all administrators and privileged users to complete their MFA registration as soon as possible rather than waiting until the deadline.

If your organization uses Microsoft Entra ID as your SSO provider, please treat this as an urgent action item. You will need to open a Salesforce Support ticket to request a 90-day deferral before enforcement takes effect.

If you have any questions about these changes, are unsure whether your org or users are affected, or would like hands-on assistance working through any of the steps outlined above, please do not hesitate to reach out to Prolocity. We are here to help make sure your team stays up and running without disruption.