Added, Removed, and Reclassified Single Sign-On Authentication Signals for Multi-Factor Authentication
For multi-factor authentication (MFA) requirements, Salesforce has added support for some single sign-on (SSO) authentication signals and removed support for others. Salesforce has also reclassified several signals from phishing-resistant to standard.
Where: This change applies to all editions.
Why: Salesforce requires MFA for all internal users. For privileged users, such as admins, Salesforce enforces a higher level of security by requiring phishing-resistant MFA methods. You can satisfy these requirements for SSO logins by using your identity provider's MFA service. Your identity provider must signal that the SSO login uses MFA by sending supported authentication signals to Salesforce—Authentication Methods References (AMR) or Authentication Context Class Reference (ACR) signals.
How: Here's what has changed:
Added Values
- Now supported as phishing-resistant:
smartcardpkisoftwarepkix509phr
- Now supported as standard:
rsa
Removed Values
These values are no longer supported and can't be used for MFA at all.
wiamultipleauthn
Reclassified Values
These values were previously classified as phishing-resistant, but are now classified as standard and no longer meet MFA requirements for privileged users.
vbmpinuser
For a full list of all supported AMR and ACR values, see these articles.