Before you enable passkey enforcement for mobile SDK apps on iOS, turn on native browser authentication in My Domain. Otherwise, users who register passkeys are permanently locked out of your mobile app and must reinstall it or clear app data to recover.
Why: Without native browser authentication enabled, iOS users get trapped in an authentication loop after registering passkeys. They're required to verify with their passkey at every login due to MFA enforcement, but the login flow can't present the passkey challenge. When you enable this setting before passkey registration, login routes through Safari, which fully supports passkeys and prevents lockout scenarios.
Salesforce is enforcing phishing-resistant multi-factor authentication (MFA) for all users with the System Administrator profile, Modify All Data, View All Data, Customize Application, or Author Apex permissions. Enable native browser authentication for iOS in My Domain on mobile SDK apps before the requirement begins.
How: Before you enable passkey enforcement, turn on native browser authentication for iOS. From Setup, in the Quick Find box, enter My Domain, select My Domain, and then select Use the native browser for user authentication on iOS under Authentication Configuration.