Salesforce Two-Factor Authentication: Complete Setup Guide
Quick Summary:
Salesforce has required MFA for all direct UI logins since February 2022 — this is no longer optional. Setup takes 5-10 minutes per user using either Salesforce Authenticator or a third-party authenticator app.
What Is Two-Factor Authentication?
Two-factor authentication (2FA), which Salesforce refers to as multi-factor authentication (MFA), requires a second verification step beyond username and password — typically a time-based code from an authenticator app, or a push notification approval — before granting access to the org. The idea is straightforward: a stolen or guessed password alone is no longer enough to get in.
This matters more than it might first appear. Password reuse across services is extremely common, and a breach at an unrelated website can expose credentials that happen to match a user's Salesforce login. MFA closes that specific gap — even with a valid password in hand, an attacker still needs physical access to the user's registered device.
⚠️ This Is Not Optional
Salesforce enforces MFA as a contractual requirement for all customers accessing Salesforce products through the UI. Orgs that haven't enabled it are technically out of compliance with Salesforce's own terms of use, even though enforcement mechanics vary by edition and login method. This isn't a "nice to have" security enhancement anymore — it's baseline.
Why It Matters Beyond Compliance
Credential-based attacks remain one of the most common ways orgs get compromised — not through some exotic exploit, but through a reused or phished password. A support rep with elevated data access, a sales manager who can export the full pipeline, an admin with system-wide permissions: each of these accounts becomes a genuinely serious risk if protected by password alone. MFA doesn't eliminate risk entirely, but it removes the single point of failure that a leaked password represents.
Comparing Verification Methods
| Method | Security Level | Setup Difficulty | Works Offline |
|---|---|---|---|
| Salesforce Authenticator (push) | High | Easy | No |
| Third-party TOTP app (Google Authenticator, Authy) | High | Easy | Yes |
| Physical security key (FIDO2/WebAuthn) | Highest | Moderate | Yes |
| SMS (fallback only) | Lower | Easiest | No |
How to Set It Up
Go to Setup → Identity → Session Settings and confirm High Assurance session security is available for your edition.
Assign the Multi-Factor Authentication for User Interface Logins permission via a permission set to the users who need it (recommended: assign to all users, not selectively).
Have each user install Salesforce Authenticator (recommended) or a third-party TOTP app like Google Authenticator or Authy on their phone.
On next login, the user will be prompted to connect their authenticator app, typically by scanning a QR code shown on screen.
Confirm rollout by checking Setup → Users and reviewing which accounts show MFA as verified versus still pending.
For users without a smartphone, Salesforce supports a physical security key (FIDO2/WebAuthn) as an alternative verification method.
🚫 Common Mistake
Relying on SMS-based verification as the primary method. SMS is more vulnerable to interception (SIM-swapping attacks) than an authenticator app, and Salesforce itself recommends against it as a primary factor — it exists mainly as a fallback for users who genuinely can't use an authenticator app.
💡 Pro Tip
Salesforce Authenticator supports one-tap push approval instead of manually typing a code, which meaningfully speeds up login for users who authenticate multiple times a day. It also shows contextual information (location, browser) with each approval request, making it easier to spot a login attempt that isn't actually you.
Troubleshooting Common Issues
User lost their phone: An admin can disconnect the user's MFA method from Setup → Users → [user] → Disconnect, which forces re-registration on next login.
MFA prompt not appearing: Usually means the permission set with the MFA permission hasn't actually been assigned to that user, even if it exists in the org.
User locked out during setup: Temporarily disconnect their MFA registration as above, or use a connected app exception if your org has one configured for emergency access.
Frequently Asked Questions
Can I exempt specific users from MFA?
Technically yes through permission set assignment, but this isn't recommended — every unprotected account is a potential entry point, and Salesforce's own terms expect MFA across the org.
Does MFA apply to API access, not just UI logins?
The UI login requirement is what's contractually mandated. API access has its own security model (OAuth, connected apps, IP restrictions) that should be configured separately.
What happens if a user fails MFA verification repeatedly?
Salesforce doesn't lock the account after failed MFA attempts the way it does for password attempts, but repeated failures are visible in login history and worth investigating.
Is Salesforce Authenticator free?
Yes, it's a free app available for iOS and Android, and it's Salesforce's own recommended method — no separate licensing cost.
Can a single authenticator app be used for multiple Salesforce orgs?
Yes, Salesforce Authenticator supports connecting to multiple orgs and accounts within the same app, showing each as a separate connected account.
What\'s the difference between MFA and Single Sign-On (SSO)?
SSO lets users log in once to access multiple systems using one identity provider; MFA adds a second verification factor to any login, including SSO logins. They solve different problems and are often used together.
Does enabling MFA slow down daily login for users?
Marginally — a push approval takes a few seconds. Most users find this negligible compared to the security benefit, especially with one-tap approval via Salesforce Authenticator.
Can I use a hardware security key instead of a phone app?
Yes, Salesforce supports FIDO2/WebAuthn-compatible physical security keys as an alternative or additional verification method, useful for users without smartphones or in high-security environments.
Will MFA affect users accessing Salesforce through a mobile app?
The Salesforce mobile app has its own biometric or PIN-based unlock that can satisfy the verification requirement once the device itself has been registered for MFA.
How do I audit which users have MFA actually enabled?
Setup → Users provides a view of registered verification methods per user; for org-wide reporting, Login History and Event Monitoring (where licensed) provide more detailed audit trails.