When multi-factor authentication (MFA) requirements are enforced in your org, users must verify their identity to register new verification methods. Users can verify their identity with another verification method that's already registered on their account. If they don't have a registered verification method, Salesforce sends a one-time verification code to their email address or phone number.
Where: This change applies to Lightning Experience and Salesforce Classic in all editions.
When: This change takes effect when new MFA requirements are enforced in your org. For detailed timelines, see these articles.
- Prepare for MFA Enforcement for All Employee Users
- Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins
How: With this change, the "Require identity verification during multi-factor authentication (MFA) registration" setting on the Identity Verification page in Setup is now automatically enabled and grayed out. To change this setting, contact Salesforce Customer Support.
When a user tries to add a new verification method, they're prompted to verify their identity with the most secure method registered on their account, using this order from most secure to least:
- (1) Passkeys (Touch ID or Face ID, Windows Hello, password managers, or security keys)
- (2) Salesforce Authenticator mobile app
- (3) One-time password generator app, such as Google Authenticator
If the user doesn't have any verification methods registered, Salesforce sends a one-time code to the user's phone number (SMS) or email address. Phone number takes precedence over email address.