If you’ve received a notification from Salesforce about multi-factor authentication recently, you’re not alone. Salesforce has been moving toward mandatory MFA for years, but this summer the waiver period is over. The permission that allowed businesses to skip or delay MFA enforcement is going away, and there are no extensions.

For businesses that have been putting this off, the deadline is here. For businesses that think they’re already covered, now is a good time to verify.

What MFA Actually Is and Why Salesforce Is Requiring It

Multi-factor authentication is the second step in your login process — after entering your password, you verify your identity through a separate method, like an app on your phone or a fingerprint reader. The idea is that even if someone gets hold of a password, they still can’t get in without that second factor.

Salesforce has technically required MFA since 2022, but there’s been a permission in the system that allowed organizations to waive the requirement for specific users. That permission is being removed. Once enforcement hits, every user in your Salesforce org will need to complete MFA at login, no exceptions.

The timing is tied directly to Salesforce’s AI expansion. As Agentforce and other AI tools become more capable of taking action inside the platform, Salesforce needs to ensure the underlying access controls are airtight. MFA is the foundation of that.

Two Different Enforcement Standards

Not all users are facing the same requirement. Salesforce has split this into two tiers.

All Users: Standard MFA

Every user in your Salesforce org needs to be on MFA. A standard authenticator app — Google Authenticator, Microsoft Authenticator, Salesforce Authenticator — qualifies. If your team is already using one of these, they’re in good shape. If anyone has been operating without MFA through a waiver or a workaround, that path is closing.

Privileged Users: Phishing-Resistant MFA

Users with elevated access face a stricter requirement. Salesforce defines privileged users as system administrators and anyone with permissions to modify all data, view all data, customize the application, or write Apex code. For these users, a standard authenticator app is no longer sufficient.

They’ll need to authenticate using either a physical security key — a small USB or NFC device they plug in or tap — or the built-in biometric reader on their computer, like Touch ID on a MacBook or Windows Hello on a PC. Salesforce calls this phishing-resistant MFA because these methods can’t be intercepted or spoofed the way a one-time code can.

For most businesses, the biometric option is the path of least resistance. It’s already built into most modern computers and doesn’t require purchasing additional hardware. But it does require intentional setup, and it needs to be communicated clearly to the users it affects.

What This Means If You Have Shared Logins

One scenario worth calling out specifically is shared logins. Some businesses, and many Salesforce consulting partners, use shared credentials to access client environments. Phishing-resistant MFA creates a real challenge here because biometric authentication is tied to a specific device and a specific person.

If your business uses shared admin credentials for any reason, this is something to address directly with your Salesforce administrator or consulting partner before the enforcement deadlines hit. The workarounds being explored involve single sign-on solutions and identity management tools, but they require planning.

This Is Also a Good Moment to Review Who Has Admin Access

The phishing-resistant MFA requirement applies to anyone with privileged permissions — and in many Salesforce environments, those permissions have been granted broadly over time. It’s common for businesses to give users admin access for convenience, to let them do one specific thing, and then never revisit it.

Every user with those permissions will now face an additional step at login. That’s a reasonable price for users who genuinely need that level of access. For users who don’t, it’s unnecessary friction — and an unnecessary security exposure.

Pull a list of your privileged users before the deadlines hit. Ask whether each person on that list actually needs the permissions they have. This is the kind of access audit that rarely gets done proactively, and this enforcement is a natural trigger to do it right.

The Deadlines You Need to Know

Salesforce is rolling this out in stages. Sandbox environments, which are the testing and development versions of your Salesforce org, are hit first. Production environments, where your actual business data lives and your team works every day, follow about a month later.

If you haven’t confirmed with your Salesforce administrator that MFA is fully in place for all users — including the phishing-resistant requirement for privileged users — that conversation needs to happen this week.

How to Get Ahead of This

The steps are straightforward, but they require someone to own them.

First, confirm that standard MFA is enabled for all users in your org. Your Salesforce administrator can pull a report on this. Second, identify every user who falls into the privileged category and confirm they’re set up for phishing-resistant authentication. Third, communicate to your broader team that they may see changes to their login experience and what to do if they get stuck.

Salesforce has published detailed documentation on all of this, and it’s worth pointing your administrator there if they haven’t already reviewed it.

If you’re not sure where your org stands or what any of this means for your specific environment, reach out using the link in the show notes. This is exactly the kind of thing our team works through with clients.

Listen to the full podcast episode here.

Related Resources

• What Phishing-Resistant MFA Means for Your Salesforce Admins
• Who Should Have Admin Access in Your Salesforce Org — And Why It Matters More Than Ever
• Why Your Team Might Get Stopped Mid-Report in Salesforce — And What to Tell Them
• The Salesforce Summer ’26 Release: What Business Leaders Actually Need to Know