Salesforce Security Guide
jNewer Version Available
Multi-Factor Authentication Considerations
| Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience |
| Available in: Essentials, Group, Professional, Enterprise, Performance, Unlimited, Developer, and Contact Manager Editions |
- Service-based—Also known as device activation, service-based authentication is automatically enabled for all orgs. This feature requires a user to provide a verification method when accessing Salesforce from an unrecognized browser or application.
- Policy-based—Admins enable policy-based multi-factor authentication. It is an admin’s best tool to protect org user accounts. See the following sections for more information.
Org Policies That Require Multi-Factor Authentication
Set policies that require a second level of authentication for every login, logins through the API (for developers and client applications), or access to specific features. Users provide the second factor via a verification method. Users can download and install a mobile authenticator app, such as the Salesforce Authenticator app or the Google Authenticator app, on their mobile device. They can also use a U2F security key. After users register an authenticator app or security key to connect the method with their Salesforce account, they can use the method whenever your org’s policies require MFA.
The Salesforce Authenticator mobile app (version 2 and later) sends a push notification to the user’s mobile device when the Salesforce account requires identity verification or MFA. The user responds on the mobile device to verify or block the activity. The user can enable location services for the app and automate verifications from trusted locations, such as a home or office. Salesforce Authenticator also generates verification codes, also called time-based one-time passwords (TOTPs). Users can choose to enter a password plus the code instead of responding to a push notification from the app for two-factor verification. Or they can get a verification code from another authenticator app.
If users lose or forget the device they usually use for MFA, you can generate a temporary verification code for them. You set when the code expires, from 1 to 24 hours after you generate it. Your user can use the code multiple times until it expires. A user can have only one temporary code at a time. If a user needs a new code while the old code is still valid, you can expire the old code, then generate a new one. Users can expire their own valid codes in their personal settings.
Customize Multi-Factor Authentication
- Require it for every login. Set the MFA login requirement for every time the user logs in to Salesforce. You can also enable this feature for API logins, which includes the use of client applications like the Data Loader. For more information, see Set Multi-Factor Authentication Login Requirements or Set Multi-Factor Authentication Login Requirements for API Access.
- Use high assurance authentication. Sometimes you don’t need MFA for every user’s login, but you want to secure certain resources. If the user tries to use reports or a connected app, Salesforce prompts the user to verify their identity. For more information, see Session Security Levels.
- Use profile policies and session settings. First, in the user profile, set
Session security level required at login to
High Assurance. Then set session security levels
in your org’s session settings to apply the policy for particular login
methods. In your org’s session settings, review the session security levels
to make sure that Multi-Factor Authentication is in the High Assurance
column. For more information, see Set Multi-Factor Authentication Login Requirements.
Only authentication flows that include a user approval step support using API logins with the High Assurance session security level. These flows are the OAuth 2.0 refresh token flow, web server flow, and user-agent flow. All other flows, such as the JSON Web Token (JWT) bearer token flow, don’t include a user approval step. For flows without a user approval step, API logins with the High Assurance session security level are blocked.
It’s possible that users are prompted to verify their identity with multi-factor authentication twice during the OAuth approval flow. The first challenge occurs in the UI session. The second challenge happens when the access token is bridged into the UI. This second challenge is triggered because the High Assurance session security level isn’t transferred to the access token.
- Use login flows. Use Flow Builder and profiles to build post-authentication requirements as the user logs in, including custom MFA processes. For more information, see the following examples.