As cyberattacks grow more common, passwords are no longer a sufficient safeguard against unauthorized account access. Multi-factor authentication (or MFA) adds an extra layer of protection against threats like phishing attacks, increasing security for your business and your customers. That’s why, beginning February 1, 2022, Salesforce will start requiring customers to enable MFA in order to access Salesforce products.

How MFA Works

MFA requires a user to validate their identity with two or more forms of evidence or factors when they log in. One factor is something the user knows, such as their username and password combination. Other factors are verification methods that the user has in their possession. While there’s a risk that a password may be compromised, it’s highly unlikely that a bad actor can also gain access to a strong verification method like a security key or authentication app.

Salesforce MFA for Direct Logins

Salesforce offers simple, innovative MFA solutions that provide a balance between strong security and user convenience. Salesforce products support several types of strong verification methods to satisfy your business and user requirements.

  • Salesforce Authenticator Mobile App: A fast, frictionless solution that makes MFA verification easy via simple push notifications that integrate into your Salesforce login process. Use this app in your MFA implementation to increase security while driving a better user experience.
  • Third-Party Authenticator Apps: Authenticate with apps that generate temporary codes based on the OATH time-based one-time password (TOTP) algorithm. There are many apps available, including Google AuthenticatorTM, Microsoft AuthenticatorTM, and AuthyTM.
  • Security Keys: These small physical devices are easy to use because there’s nothing to install and no codes to enter. Security keys are a great solution if mobile devices aren’t an option for your users. Salesforce supports USB, Lightning, and NFC keys that support the WebAuthn or U2F standards, including Yubico’s YubiKeyTM and Google’s TitanTM Security Key.
  • Built-In Authenticators: Easy MFA verification using a desktop or mobile device’s built-in authenticator service, such as Windows HelloTM, Touch ID(R), or Face ID(R). (Currently available for Heroku, Marketing Cloud-Social, and MuleSoft Anypoint Platform only.)
Learn More >

Learn More About MFA

How MFA Works

See how MFA works and why it’s a critical piece of your defense-in-depth strategy.
Watch Video >

Admin Guide

Learn the recommended process for implementing and rolling out MFA to your users.
View Guide >


Get answers to common questions about MFA for Salesforce, including the MFA requirement.
View FAQ >

MFA for Your Salesforce Products

Launch MFA for Platform

Learn how to enable MFA and how users can register and use Salesforce Authenticator for MFA logins

Watch the Launch MFA Video >
User Authentication

Use Trailhead to learn about securing your org with MFA, SSO, and My Domain

Earn the User Authentication Badge >
MFA for B2C Commerce

Get started with a high-level overview of the steps to enable MFA for B2C Commerce

View the MFA Page for B2C Commerce >
B2C Commerce Roles and Permissions

Use Trailhead to set up users and assign roles and permissions in Business Manager

Earn the B2C Commerce Permissions Badge >
Knowledge Article
MFA for Datorama

Learn how to implement MFA for Datorama users (requires Datorama login)

View the Marketing Cloud Datorama Article >
MFA for Datorama FAQ

Get answers to common questions about MFA for Datorama (requires Datorama login)

View the Datorama MFA FAQs >
Launch MFA for Marketing Cloud

Learn how to enable MFA for Marketing Cloud and how users can register and use Salesforce Authenticator for MFA logins

Watch the Marketing Cloud MFA Video >
Salesforce Help
MFA for Marketing Cloud Help

Learn how to set up MFA for Marketing Cloud tenants

View Marketing Cloud MFA Help >
Salesforce Help
MFA for MuleSoft Help

Learn how to implement MFA for Anypoint Platform users

View MuleSoft MFA Help >
Knowledge Article
Enable MFA for your Quip Site

Learn how to implement MFA for Quip Starter, Quip Enterprise, and Quip for Customer 360

View the Quip MFA Help Article >

Report a Security Concern

As a leading software-as-a-service and platform-as-a-service provider, Salesforce is committed to setting the standard in safeguarding our environment and customers’ data. Partner with us by reporting any security concerns.

Report a Concern