---
schema_version: "1"
id: ea6d27f8e02b783cb537c06e509439cecc0313a03f455fa61049e1b96ac40cbf
title: Added, Removed, and Reclassified Single Sign-On Authentication Signals for Multi-Factor Authentication
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_new_amr_acr_values.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_new_amr_acr_values.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4bb4d2270d75ee9da065b3441e53728c0284fefb3a09081669eca7952c049cd8
description: For multi-factor authentication (MFA) requirements, Salesforce has added support for some single sign-on (SSO) authentication signals and removed support for others. Salesforce has also reclassified several signals from phishing-resistant to standard.
products:
  - Cross Cloud
release: "262"
---
# Added, Removed, and Reclassified Single Sign-On Authentication Signals for Multi-Factor Authentication

For multi-factor authentication (MFA) requirements, Salesforce has added support for some single sign-on (SSO) authentication signals and removed support for others. Salesforce has also reclassified several signals from phishing-resistant to standard.

**Where:** This change applies to all editions.

**Why:** [Salesforce requires MFA for all internal users.](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1) For privileged users, such as admins, Salesforce enforces a higher level of security by [requiring phishing-resistant MFA methods](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US). You can satisfy these requirements for SSO logins by using your identity provider's MFA service. Your identity provider must signal that the SSO login uses MFA by sending supported authentication signals to Salesforce—Authentication Methods References (AMR) or Authentication Context Class Reference (ACR) signals.

**How:** Here's what has changed:

## Added Values

- Now supported as phishing-resistant:
    - `smartcardpki`
    - `softwarepki`
    - `x509`
    - `phr`
- Now supported as standard:
    - `rsa`

## Removed Values

These values are no longer supported and can't be used for MFA at all.

- `wia`
- `multipleauthn`

## Reclassified Values

These values were previously classified as phishing-resistant, but are now classified as standard and no longer meet MFA requirements for privileged users.

- `vbm`
- `pin`
- `user`

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/images/icon_note.png)

Note

For a full list of all supported AMR and ACR values, see these articles.

- [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1)
- [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&language=en_US&type=1)