Use the SAML Assertion Validator to determine whether your single sign-on (SSO) provider satisfies multi-factor authentication (MFA) requirements, including phishing-resistant MFA for privileged users. The validator now shows you whether your SSO provider’s authentication signals are classified as phishing-resistant, standard, or weak. Previously, it only classified values as strong or weak.
Where: This change applies to Lightning Experience and Salesforce Classic in all editions.
When: This change is available on a rolling basis starting on July 15, 2026.
Why: By determining verification method strength, you can easily check whether your SAML SSO provider meets Salesforce MFA requirements. This includes the MFA requirement for employee users and the stricter phishing-resistant MFA requirement for privileged users, such as admins. For more information, see these articles.
- Prepare for MFA Enforcement for All Employee Users
- Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins
How: First, obtain a SAML assertion from your SSO provider. To access the SAML validator, from Setup, use the Quick Find box to find and select Single Sign-On Settings. Click SAML Assertion Validator. Enter your SAML assertion and run the validator. The validator displays all Authentication Context Class Reference (ACR) and Authentication Methods References (AMR) values that Salesforce detected in the SAML assertion. For each value, the validator tells you whether it’s phishing-resistant, standard, or weak.