---
schema_version: "1"
id: 8d6593f7a019c288a0b21523a91b0fccdfc2aff03646405cb0ee368ff0c25bda
title: Multi-Factor Authentication
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/data_sandbox_mfa.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.data_sandbox_mfa.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1c44e889e6506d8566b3f773280513b9a70983a08a9044e0c55f0c9128c0cb27
description: Sandbox environments aren’t contractually required to use multi-factor authentication (MFA). But we strongly recommend using MFA for sandboxes that include intellectual property, customer data, or other Salesforce production data. To develop a strategy for managing MFA in sandbox environments, review these considerations.
products:
  - Salesforce Platform
release: "264"
---
# Multi-Factor Authentication

Sandbox environments aren’t contractually required to use multi-factor authentication (MFA). But we strongly recommend using MFA for sandboxes that include intellectual property, customer data, or other Salesforce production data. To develop a strategy for managing MFA in sandbox environments, review these considerations.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Database.com</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d3712e73">User Permissions
            Needed</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d3712e73 ">To view a sandbox:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d3712e73 ">View Setup and Configuration</td>

        </tr>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d3712e73 ">To create, refresh, activate, and delete a sandbox:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d3712e73 ">Manage Dev Sandboxes (Developer or Developer Pro only) or Manage Sandboxes (all
            sandbox types)</td>

        </tr>
      </tbody>
    </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-deploy_sandboxes-264-0-0-production-enus/654e51d1-6795-49fe-bd43-b5385950cf4a/images/icon_note.png)

Note To learn more about the MFA requirement, see the [Salesforce Multi-Factor Authentication FAQ](https://help.salesforce.com/apex/HTViewSolution?urlname=Salesforce-Multi-Factor-Authentication-FAQ).

- When you create or refresh a sandbox, all Multi-Factor Authentication for User Interface Logins user permission assignments — whether set via profiles or permission sets — are copied over from your production org. However, none of the MFA verification methods that a user has registered for your production org are copied to your sandbox. As a result, all MFA-enabled users must register an MFA method the first time they log in to a new sandbox. And they must repeat this step each time the sandbox is refreshed.
- If a user registers Salesforce Authenticator as an MFA verification method for their sandbox account, the connection to the account is invalidated each time the sandbox is refreshed. But the connection details aren’t automatically removed from Salesforce Authenticator. To avoid a long list of invalid connected accounts in Salesforce Authenticator, users should manually delete their old sandbox account from the app each time the sandbox is refreshed.
    
    Salesforce Authenticator assigns the same default name each time a user registers the app for their sandbox account. To avoid losing track of which sandbox connected accounts are active and which are invalid, delete the old sandbox account before logging in to the new version of the sandbox.
- If you use SSO for access to your production org but want to use MFA instead of SSO for your sandboxes, do so by assigning the Multi-Factor Authentication for User Interface Logins user permission to users when you create or refresh a sandbox.
    
    But when you deploy customizations to your production org, take care that you don’t accidentally include the sandbox’s MFA configuration. To help keep MFA isolated to your sandbox:
    
    - Use a dedicated permission set to assign the Multi-Factor Authentication for User Interface Logins permission to sandbox users.
    - Give the permission set an obvious MFA-related name so it’s easy to distinguish it from other permission sets.
    - Create a checklist that reminds Salesforce admins to exclude the MFA permission set from each deployment.

#### See Also

- [Implement Multi-Factor Authentication](https://help.salesforce.com/s/articleView?id=xcloud.security_2fa_config.htm&type=5&language=en_US)
- [Register Verification Methods for Multi-Factor Authentication](https://help.salesforce.com/s/articleView?id=xcloud.security_register_verification_methods.htm&type=5&language=en_US)