Multi-Factor Authentication Customizations

Multi-factor authentication (MFA) is one of the easiest, most effective tools for enhancing login security, and safeguarding your business and data against security threats. As you roll out your Salesforce MFA implementation, you can customize it to meet your business needs.

Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience

Available in: Essentials, Group, Professional, Enterprise, Performance, Unlimited, Developer, and Contact Manager Editions

As of February 1, 2022, Salesforce is requiring MFA for all users who log in to the Salesforce UI. For more information about this requirement, see Announcement of the Future Requirement to Enable Multi-Factor Authentication (MFA) and Salesforce Multi-Factor Authentication FAQ.

MFA was formerly called two-factor authentication or 2FA.

Note

You can customize MFA in these ways.

Enable MFA with Session Security Levels
You can enable multi-factor authentication (MFA) using the security level, either standard or high assurance, assigned to a login method in your Salesforce session settings.
Set Multi-Factor Authentication Login Requirements for API Access
You can require multi-factor authentication (MFA) for API access using the Multi-Factor Authentication for API Logins permission. With this permission enabled, users are required to complete a second authentication challenge to access Salesforce APIs. API access includes the use of client applications such as the Data Loader and connected apps.
Connect Salesforce Authenticator to a Salesforce Account for Identity Verification
The Salesforce Authenticator mobile app is a verification method that your users can employ as another authentication factor in addition to their usernames and passwords. Refer your users to the links listed so they can connect their Salesforce account to Salesforce Authenticator.
Verify Your Identity with a TOTP Authenticator App
Register a third-party authenticator app, like Salesforce Authenticator or Google Authenticator, as a verification method for verifying your identity. The app generates a verification code called a time-based one-time password (TOTP).
Disconnect Salesforce Authenticator from a User’s Account
Only one Salesforce Authenticator mobile app can be connected to a user’s account at a time. If your user loses access to the app by replacing or losing the mobile device, disconnect the app from the user’s account. As long as the user or assigned profile still has the multi-factor authentication permission enabled and no other verification method is connected to their account, Salesforce prompts the user to register a new method the next time they log in.
Disconnect a User’s TOTP Authenticator App
Besides Salesforce Authenticator, one other mobile authenticator app that generates verification codes (time-based one-time passwords) can be connected to a user’s account at a time. If your user loses access to the app by replacing or losing the mobile device, disconnect the app from your user’s account. The next time your user logs in with multi-factor authentication (MFA), if no other identity verification method is connected, Salesforce prompts the user to register a new method.
Generate a Temporary Identity Verification Code
Generate a temporary verification code for users who can’t access the identity verification method that they usually use for multi-factor authentication (MFA). Set the code's expiration for from 1 to 24 hours after you generate it. The code can be used multiple times until it expires.
Expire a Temporary Verification Code
Expire a user’s temporary verification code when the user no longer needs it for multi-factor authentication (MFA).
Implement Multi-Factor Authentication with Apex
To implement your own multi-factor authentication (MFA) process, use Apex methods under the System.UserManagement class. The methods come as a pair for email, phone (SMS), and the Salesforce Authenticator verification methods—one to initiate a verification service, and one to complete the verification service. For password or time-based one-time password (TOTP) verification methods, you can use the second method alone to provide a complete verification service.
Delegate Multi-Factor Authentication Management Tasks
Let users who aren’t Salesforce admins provide support for multi-factor authentication (MFA) in your org. For example, suppose you want your company’s Help Desk staff to generate temporary verification codes for users who lost or forgot the device they usually use for MFA. Assign Help Desk staff members the Manage Multi-Factor Authentication in User Interface user permission so that they can generate codes and support end users with other MFA tasks.

Salesforce Security Guide

See Also