--- schema_version: "1" id: b05925d867176c8b3285e7367b6a06382ac9d81d8ff2ac498024b4b6e5b41196 title: Multi-Factor Authentication for Marketing Cloud Engagement collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_mfa.md canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 910e8723d49512dd1089be79c27249d975e1b6bc6dae4611ac95f498e258a817 description: Multi-factor authentication (MFA) enhances your Marketing Cloud Engagement login process by adding another layer of protection against common security threats, including phishing attacks, credential stuffing, and account takeovers. With MFA, a user provides two factors to prove their identity—their username and password combination plus a supported verification method—before they can log in. Even if a user’s credentials are compromised, the additional factor helps prevent unauthorized access. products: - Marketing - Marketing Cloud Engagement release: "264" --- # Multi-Factor Authentication for Marketing Cloud Engagement Multi-factor authentication (MFA) enhances your Marketing Cloud Engagement login process by adding another layer of protection against common security threats, including phishing attacks, credential stuffing, and account takeovers. With MFA, a user provides two factors to prove their identity—their username and password combination plus a supported verification method—before they can log in. Even if a user’s credentials are compromised, the additional factor helps prevent unauthorized access. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_important.png) Important MFA is part of the login experience and can’t be turned off. If MFA isn’t enforced for your tenant yet, [turn it on](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_transition.htm&release=264.0.0&type=5 "For most tenants, multi-factor authentication (MFA) is integrated with the Marketing Cloud Engagement login experience and can’t be disabled. If Salesforce hasn’t made MFA mandatory for your tenant yet, you should do so yourself as soon as possible. Follow these steps to transition from Identity Verification (IDV) to multi-factor authentication (MFA).") and [register a verification method](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_enable_account.htm&release=264.0.0&type=5 "Configure a multi-factor authentication (MFA) method to provide an additional layer of security for your Marketing Cloud Engagement account. MFA is required for all users and can’t be turned off. The first time you log in to your account, you must register an MFA verification method. On all subsequent logins, you must log in using MFA."). MFA requires that you add IP addresses to your allowlist. [Review this list](https://help.salesforce.com/s/articleView?id=mktg.mc_es_ip_addresses_for_inclusion.htm&release=264.0.0&type=5 "Add the Salesforce IP address to your allowlists so that your users can process login authentication requests. Allowing the entire set of IP addresses avoids unintended service disruptions caused by movement between primary and secondary instances.") for the correct values. Marketing Cloud Engagement supports several MFA methods. - The [Salesforce Authenticator](https://www.salesforce.com/solutions/mobile/app-suite/security/) mobile app - Physical security keys that support [WebAuthn](https://webauthn.guide/) or [U2F](https://fidoalliance.org/specs/u2f-specs-master/fido-u2f-overview.html), such as [YubiKey](https://www.yubico.com/products/) from Yubico and [Titan Security Key](https://support.google.com/titansecuritykey/answer/9115487?hl=en) from Google - Platform authentication systems such as Touch ID and Face ID on Apple devices, Biometrics on Android devices, and Windows Hello - Time-based one-time passcode ([TOTP](https://datatracker.ietf.org/doc/html/rfc6238)) authenticator apps like [Google Authenticator](https://support.google.com/accounts/answer/1066447?co=GENIE.Platform%3DAndroid&hl=en), [Microsoft Authenticator](https://www.microsoft.com/en-us/security/mobile-authenticator-app), and [Authy](https://www.authy.com/) Of these methods, physical security keys and platform authentication systems are phishing-resistant MFA (PR-MFA) methods. PR-MFA methods offer the most secure experience because they can’t be intercepted in phishing attacks. Enterprise accounts allow MFA enablement and settings changes at the top-level account in the tenant. Business units can only view MFA settings in their accounts. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_note.png) Note Single sign-on (SSO) isn’t compatible with MFA. If your org uses SSO, turn on your SSO provider’s MFA service for your Engagement users. ## Changes to Your Account with Multi-Factor Authentication As of Summer ’22, MFA replaces the current Identity Verification feature in Marketing Cloud Engagement. All users (except for SSO users) must authenticate via username, password, and MFA verification method. This setting applies to all users and all physical locations. Previously used Identity Verification allowlists don’t apply to MFA login attempts. These settings are inactive in Setup when you turn on MFA. The functionality doesn’t impact how MFA functions in your tenant. - Identity Verification - Business Unit Identity Verification - Browser Verification Code Lifetime - Time a browser can be inactive before requiring verification - Allow machines not on Allowlisted IP Addresses access - Don’t require Identity Verification for machines inside the allowlist - Don’t require Identity Verification for SSO Logins To learn more about MFA, see these topics. - **[Enable and Require MFA for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_transition.htm&release=264.0.0&type=5)** For most tenants, multi-factor authentication (MFA) is integrated with the Marketing Cloud Engagement login experience and can’t be disabled. If Salesforce hasn’t made MFA mandatory for your tenant yet, you should do so yourself as soon as possible. Follow these steps to transition from Identity Verification (IDV) to multi-factor authentication (MFA). - **[Configure MFA Verification for Marketing Cloud Engagement Logins](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_enable_account.htm&release=264.0.0&type=5)** Configure a multi-factor authentication (MFA) method to provide an additional layer of security for your Marketing Cloud Engagement account. MFA is required for all users and can’t be turned off. The first time you log in to your account, you must register an MFA verification method. On all subsequent logins, you must log in using MFA. - **[Manage Your MFA Verification Methods for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_manage.htm&release=264.0.0&type=5)** Follow these steps to manage the multi-factor authentication (MFA) verification methods for Marketing Cloud Engagement. - **[Revoke an MFA Verification Method for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_manage_admin.htm&release=264.0.0&type=5)** If a user loses their multi-factor authentication (MFA) verification method, a Marketing Cloud Engagement admin can disconnect it for them. Each user account must have one registered method for access. If the user hasn't registered additional methods, they're prompted to set up a new method the next time they log in. - **[View MFA Events in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_events.htm&release=264.0.0&type=5)** You can review a log of all multi-factor authentication (MFA) registration and verification attempts for your account. This log includes enablement and revocation actions and authentication attempts. Marketing Cloud admins can view all events in a tenant. Specific users see only those events related to their account. - **[Generate a Temporary MFA Verification Code for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_temporary_code.htm&release=264.0.0&type=5)** A Marketing Cloud Engagement admin can generate a temporary verification code for a user who forgot or lost their multi-factor authentication (MFA) verification method. This code is effective for 24 hours. The user can enter this code multiple times until 24 hours elapses or you revoke the code. - **[Review MFA Enrollment Status for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_status.htm&release=264.0.0&type=5)** Review the multi-factor authentication (MFA) enrollment status of users in your account to see who hasn't registered a verification method yet. - **[Multi-Factor Authentication FAQ for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_faq_main.htm&release=264.0.0&type=5)** Review some answers to common questions about multi-factor authentication (MFA) in Marketing Cloud Engagement.