Register an Identity Verification Method for Salesforce Orgs

Multi-factor authentication (MFA) is required for Salesforce logins. To access your account, you need a registered identity verification method that you provide after entering your username and password. When MFA is turned on, if you haven’t registered a method yet, you’re automatically prompted to do so at login. If you’re already logged in, you can register methods at any time. The registration process creates a connection between the chosen method and your Salesforce account. You can also use a registered verification method if you receive a device activation challenge for an unfamiliar login attempt.

Required Editions

Available in: both Salesforce Classic and Lightning Experience

Available in: all editions

• Create a Passkey

• Register a Security Key as an Identity Verification Method for Salesforce Orgs

• Register Salesforce Authenticator as an Identity Verification Method for Salesforce Orgs

• Register a Third-Party Authenticator App as an Identity Verification Method for Salesforce Orgs

Tip

We strongly encourage you to register two or more verification methods so you have a backup available for MFA if you forget or lose your primary method. You can register one method for each of the four method types listed in this topic.

If you set up multiple methods, Salesforce logins automatically ask you for the most secure type but you can always override the prompt and select a different option. Salesforce uses this order of precedence: built-in authenticators, security keys, Salesforce Authenticator, third-party TOTP authenticator apps.

• Create a Passkey
  For a secure, fast, and easy login with multi-factor authentication (MFA), create a passkey, also known as a built-in authenticator. With passkeys, you have multiple ways to log in: fingerprint or facial scanners on your device, physical security keys, a device PIN or password, or password managers. Some passkeys work only on the device where you set them up. If you set up a device-bound passkey on your laptop, you can’t use it to log in from your phone. If you log in to Salesforce from multiple devices, set up your passkeys so that you can access your account anywhere.
• Manage Passkeys and Security Keys
  Manage passkeys, including security keys, that you use to log in with multi-factor authentication (MFA). View your registered passkeys, create passkeys, and disconnect existing passkeys that you no longer use. Passkeys are also known as built-in authenticators.
• Register a Security Key as an Identity Verification Method for Salesforce Orgs
  Register a physical security key so you can use it to verify your identity when logging in with multi-factor authentication (MFA) or if you receive a device activation challenge. You can use security keys that support the WebAuthn (FIDO2) or Universal Second Factor (U2F) standards. The registration process sets up your security key as a personal verification by creating a connection between your Salesforce account and the key. If you don’t see this option, talk to your Salesforce admin about enabling it.
• Register a Third-Party Authenticator App as an Identity Verification Method for Salesforce Orgs
  Register a third-party authenticator app so you can use it to verify your identity when logging in with multi-factor authentication (MFA) or if you receive a device activation challenge. Authenticator apps, such as Google Authenticator, Microsoft Authenticator, or Authy, generate verification codes that you enter in Salesforce to verify your identity. There are mobile apps, browser extensions, and desktop options such as most password managers. You can use any third-party product that generates time-based one-time password (TOTP) codes. The registration process sets up your authenticator app as a personal verification method by creating a connection between your Salesforce account and the app.