Editor’s note: The contractual requirement to log in with multi-factor authentication (MFA) is in effect. This post was updated on June 27, 2024, with the latest information and resources.
It feels like we’ve talked about security a lot in the past year, doesn’t it? Whether you tuned into #LowCodeLove on Trailhead Live, read about washing your hands, or listened to one of our favorite Salesforce MVPs talk about her experience rolling out MFA, it’s been top of mind.
At Salesforce, we’re always thinking of ways to better protect our customers and keep their data secure. That’s why Salesforce requires customers to use multi-factor authentication (MFA) when accessing Salesforce products. This contractual requirement went into effect on February 1, 2022.
This may seem like a big change, and we want to be clear about why it’s so important for Salesforce customers to implement stronger security measures in this current environment. The cybersecurity threat landscape is always evolving to include more sophisticated methods of targeting data. In fact, cyber attacks that can harm businesses and exploit consumers are on the rise. We also saw the number of phishing websites increase by 80% in 2020, according to Google’s Safe Browsing report.
MFA enhances login security by adding an extra layer of protection against unauthorized account access. MFA can help protect user accounts from some of the most common threats, such as phishing attacks, credential stuffing, and account takeovers. It’s a secure authentication process that requires users to prove their identity by supplying two or more pieces of evidence (or “factors”) when they log in. We strongly encourage customers to implement the most current and industry-standard security measures, and MFA is at the top of this list.
To satisfy the requirement, you must do one of — or a combination of — the following:
The good news: MFA and the Salesforce Authenticator app are available at no extra cost. Salesforce also offers an SSO solution, but you should work with your IT or Security team to determine if SSO, and which IdP, is the best fit for your company.
And more good news: To help customers satisfy the requirement, MFA is now a default part of the direct login process for Salesforce products. That means it’s no longer necessary to enable MFA for direct logins yourself, giving you more time to focus on onboarding your users to MFA.
Yes — as long as all of your Salesforce products are integrated with SSO, with MFA enabled on the IdP, and all users who access a Salesforce product’s user interface do so via SSO. Note that you must use a federated SSO solution based on the Security Assertion Markup Language (SAML) or OpenID Connect standard protocols. Delegated Authentication does not satisfy the MFA requirement.
We’ve compiled a list of helpful resources to get you started on the MFA journey. As a Salesforce Admin, most of the responsibility for implementing SSO and MFA, and preparing users for MFA, will fall to you.
And join the conversation anytime in the MFA — Getting Started Trailblazer Community.
Agentforce is transforming the way businesses manage customer interactions by automating conversations across channels like chat, email, and phone. With AI-powered agents capable of resolving issues, answering questions, and executing actions on behalf of customers, organizations can significantly boost productivity by streamlining tasks that once required considerable time and resources, such as customer support and […]
As I’m sitting here in Boston, Massachusetts writing this Spring ’25 release blog, it’s about 30 degrees Fahrenheit outside. I wear ski pants out while walking Mochi, and we had snow on the ground. I am most definitely wishing it was spring right now, where I can look forward to warmer weather and the idea […]
In today’s digital landscape, ensuring the security of customer data is one of the top priorities for Salesforce Admins. With the increasing frequency of security breaches, the need for robust protection of sensitive information is more critical than ever. Exposing services to the public internet inherently opens up vulnerabilities that can lead to unauthorized access, […]
