Salesforce began enforcing multi-factor authentication for employee users in sandboxes on July 10, 2026, and in production orgs on July 20, 2026. The rollout is staggered by release group, so orgs owned by the same company may receive the change on different dates. Once enforcement reaches an org, an employee without an accepted verification method can’t complete the login process. Sales, service, development, or administration work may stop at the sign-in screen.
The rule applies to direct user-interface logins and single sign-on. It covers paid production orgs and sandboxes. Privileged users face a stricter requirement because Salesforce now expects phishing-resistant authentication for accounts with broad administrative or development rights. This article explains the current platform rule in practical terms. It doesn’t replace contract review, legal advice, or an organization’s security policy.
Enforcement makes user readiness an access requirement
The current Salesforce MFA enforcement schedule states that employee-user enforcement started in sandboxes on July 10, 2026, followed by production on July 20, 2026. Non-privileged users can use supported standard MFA methods or phishing-resistant methods. Users without a registered method see a passkey-first registration screen, although eligible non-privileged users may choose another accepted method.
A delayed rollout doesn’t remove the need to prepare. Admins should identify the applicable release group, confirm which users enter through the Salesforce interface, and test each login route. Experienced Salesforce Consultants can review identity settings, permission assignments, SSO behavior, and registration plans. The customer’s security owner should retain final policy approval.
Scope depends on the user, login route, and environment
Salesforce applies the employee MFA rule to internal users who enter through the user interface. That includes direct username-and-password access and SSO access. It covers production and sandbox orgs, so a successful production test doesn’t prove that a refreshed sandbox will behave the same way. External users with qualifying Experience Cloud or external-license access are outside this employee-user rule.
Build an accurate login inventory before changing settings. Record each active user, license type, profile, permission sets, login route, identity provider, registered method, and recovery contact. Include contractors and service providers when they use customer-issued internal licenses. A team assessing Salesforce Implementation Partners should ask how the partner separates named human access from integration access and records privileged activity.
Privileged users need phishing-resistant methods
Salesforce uses 5 routes to classify privileged users: the System Administrator profile or 1 of 4 permissions, Author Apex, Customize Application, Modify All Data, or View All Data. Those permissions may arrive through profiles or permission sets, so a profile-only review can miss affected users. The official phishing-resistant MFA enforcement guidance says the rule covers direct UI and SSO logins in production and sandbox orgs.
Privileged users can’t rely on Salesforce Authenticator or a third-party time-based one-time password app for this higher requirement. They need 1 of 2 supported phishing-resistant categories: a built-in authenticator or a security key. SSO users may still be prompted inside Salesforce when the identity provider doesn’t send accepted Authentication Methods Reference or Authentication Context Class Reference signals. SSO assertion testing must therefore be part of the implementation.
Passkeys address a weakness in manually entered codes
MFA methods don’t all resist phishing in the same way. The current NIST authenticator requirements state that manually entered authenticator outputs, including one-time passwords, aren’t phishing-resistant. An attacker operating a false login page may relay a code to the genuine service before it expires. WebAuthn-based methods bind authentication to the legitimate verifier, which blocks that relay pattern.
A capable Salesforce Implementation Services Provider should test the complete authentication event. Testing should cover device support, passkey registration, SSO signals, fallback behavior, and access after a sandbox refresh. It should also verify what happens when a user changes devices or loses the only registered authenticator. A successful setup screen doesn’t prove that recovery and daily login will work.
A controlled rollout reduces avoidable lockouts
Start with a permission-based user report, then divide users into privileged and non-privileged groups. Confirm that each person still needs elevated access. Removing an unnecessary high-risk permission may move the user out of the stricter category, provided no other qualifying profile or permission remains. Keep approval evidence for every access change.
Select approved methods based on device ownership, browser support, accessibility needs, remote-work conditions, and security policy. Provide at least 2 usable recovery paths for key administrators where policy allows it. Pre-register methods before the assigned enforcement date, then test every active login route in a sandbox and through a production-safe account.
Recovery planning needs a named owner. Salesforce says another administrator can issue a temporary identity verification code, disconnect an old method, and help with registration when a user is locked out. If no other administrator can enter the org, Salesforce Support may be needed. Keep at least 2 trained administrators where staffing permits, and store support entitlement details outside Salesforce.
User communication should explain what the prompt looks like and which methods the company permits. CISA’s MFA guidance for organizations identifies FIDO and WebAuthn as the widely available phishing-resistant approach and urges organizations to plan a move toward it. Training should warn users against approving unexpected prompts or entering codes on pages reached through unsolicited messages. Give users a verified internal channel for registration problems.
After rollout, review login history, help-desk cases, permission changes, failed SSO attempts, and authenticator resets. A focused Salesforce health check can examine MFA settings alongside profiles, permission sets, session controls, connected apps, and audit records. Repeat the review after identity-provider changes, major releases, sandbox refreshes, or administrator turnover.
Common misunderstandings create preventable failures
SSO doesn’t remove the MFA duty. Salesforce evaluates whether the identity provider performed an accepted authentication step and, for privileged users, whether the signal shows phishing-resistant authentication. A working SSO login before enforcement isn’t enough evidence that the later flow will pass.
A registered authenticator doesn’t mean every user meets the same standard. Non-privileged users may use accepted standard methods, while privileged users need passkeys or security keys. Permission changes can alter the required method without changing a person’s job title. Review access assignments during every role change.
Integration accounts require separate analysis. API flows without an interactive Salesforce UI login may fall outside this employee login enforcement, while OAuth flows that send a person through the interface can trigger MFA. Document the exact flow and avoid using a broad human account as a substitute for a properly designed integration identity.
Verify the org, then test every login route
Salesforce MFA enforcement can block unprepared users at the point of access, and privileged accounts face the strictest method rules. The internal owner should check the org’s release-group schedule, audit qualifying permissions, confirm SSO signals, and test recovery before the next workday depends on those accounts. Salesforce’s employee and privileged-user enforcement articles remain the primary sources because rollout dates and support procedures can change.
Frequently asked questions
Who is covered by Salesforce MFA enforcement?
The rule covers internal employee users who access paid Salesforce production orgs or sandboxes through the user interface. It applies to direct logins and SSO logins. External Experience Cloud users and certain non-employee license types may fall outside this rule. Confirm each license and login use case against current Salesforce guidance.
Which users are considered privileged?
A user is privileged when the account has the System Administrator profile or at least 1 of 4 named permissions. Those permissions are Author Apex, Customize Application, Modify All Data, and View All Data. Assignment through a permission set still counts. A profile-only report can therefore miss affected users.
Can privileged users keep using Salesforce Authenticator?
Salesforce Authenticator doesn’t meet the 2026 phishing-resistant requirement for privileged users. The same limitation applies to third-party apps that generate manually entered time-based codes. Privileged users need an accepted built-in authenticator or security key. Non-privileged users may retain standard MFA choices where Salesforce permits them.
Does SSO prevent Salesforce login prompts?
SSO prevents an added Salesforce challenge only when the identity provider performs the required authentication and sends accepted signals. Privileged users need signals that indicate phishing-resistant authentication. Missing or unsupported AMR or ACR values can trigger passkey registration. Test the actual assertion from each identity-provider policy.
What should an admin do before enforcement reaches the org?
Confirm the release group, inventory active users, find privileged permissions, and test every login route. Users should register approved methods before their assigned enforcement date. Document recovery steps and maintain another trained administrator where possible. Check uncertain scope or exceptions against Salesforce Help and the customer’s contract.
For more info Contact Us : 800–360–1407 or send mail : [email protected] to get a quote
Comments
Log in or sign up to join the conversation.