---
schema_version: "1"
id: ee9cd0ec9c2f27b3c5bde393563a95c459be2a1401f9204c38e1887f4cfd0cb7
title: Device Activation Is Required for Single Sign-On
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_security_sso_device_activation.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_sso_device_activation.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 130ef7d6cf5b303732661ce964b5451917353cfcd723fc36a7dcdb72068cb0b7
description: As part of ongoing measures to uplift security, we’re enforcing a new device activation requirement for users who log in via single sign-on (SSO). We’ll require device activation if the SSO provider doesn’t use authentication methods that meet Salesforce security standards. We’re enforcing this requirement in phases based on the type of identity provider.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Device Activation Is Required for Single Sign-On

As part of ongoing measures to uplift security, we’re enforcing a new device activation requirement for users who log in via single sign-on (SSO). We’ll require device activation if the SSO provider doesn’t use authentication methods that meet Salesforce security standards. We’re enforcing this requirement in phases based on the type of identity provider.

**Where:** This change applies to Lightning Experience, Salesforce Classic, and all versions of the Salesforce mobile app in all editions.

**When:** Starting on January 20, 2026, Salesforce will begin a staggered rollout of the first phase. The first phase includes all SSO configurations that use predefined authentication provider types. A predefined authentication provider is an OpenID Connect (OIDC) provider that doesn't use a [custom authentication provider plug-in](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_AuthProviderPluginClass.htm). To see if your provider type is predefined, go to the Auth. Providers page in Setup and check the Provider Type column. These provider types are predefined.

- Apple
- Bitbucket
- Concur
- Facebook
- GitHub
- Google
- Janrain
- LinkedIn
- Microsoft
- Microsoft Access Control Service
- MuleSoft
- OpenID Connect
- Salesforce
- Slack
- Twitter (X)

If the provider type is Custom, it isn't included in the first phase.

Future phases will include other SSO providers, including Security Assertion Markup Language (SAML) identity providers. Stay tuned for the rollout schedule for these phases.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-salesforce_release_notes-260-0-0-production-enus/ba62a63b-6cd1-440e-8d24-e867afab0363/images/icon_note.png)

Note Salesforce supports SSO via OIDC and SAML. Since some third-party providers support both OIDC and SAML, confirm the exact protocol with your third-party SSO provider.

**How:** With the first rollout phase, device activation will be required if the authentication provider doesn’t use MFA or doesn’t use a strong MFA method. Strong MFA methods include biometric methods, such as fingerprint or face scans, and physical security keys. To determine whether to require device activation, Salesforce checks the Authentication Method Reference (AMR) claim in the ID token.

Salesforce will enforce the requirement differently depending on the type of org.

- Active production and sandbox orgs: Enforced only for orgs with oversized IP ranges. IP ranges are oversized if the total number of IP addresses across all ranges exceeds 16,777,216. This limit applies separately to the org-wide trusted IP ranges set in your Network Access settings and to login IP ranges for a specific profile.
- Non-revenue orgs: Enforced for all orgs, regardless of IP ranges.

For more information, including a list of acceptable AMR values and an overview of future phases, see [Changes to Device Activation for Single Sign-On (SSO) Logins](https://help.salesforce.com/s/articleView?id=005237070&type=1&language=en_US).