--- schema_version: "1" id: 2f26064f25ca489a1ba1c340cde5518d7c22f0eed57f5f5871b87fb4993a46c2 title: Resolve MFA Access Issues for Your Users (Salesforce Orgs) collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_access_recovery.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_access_recovery.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: cfd2b0c24146fc7ca5be2677f616bb41cbb7082175fdd3575372ab843e2be760 description: As a Salesforce admin, part of your role is managing and maintaining user access. With multi-factor authentication (MFA) in effect for your org, it’s important to know how to resolve MFA-related access issues that users can encounter. There are three likely scenarios. A user doesn’t have access to their MFA verification method and can’t log in. A user loses or replaces a verification method and must register a new one. And the connection between a user’s registered verification method and their Salesforce account stops working. Use temporary verification codes to allow users to regain access immediately. When dealing with a broken connection or a missing verification method, revoke the connection and help the user set up a new method. products: - Security release: "264" --- # Resolve MFA Access Issues for Your Users (Salesforce Orgs) As a Salesforce admin, part of your role is managing and maintaining user access. With multi-factor authentication (MFA) in effect for your org, it’s important to know how to resolve MFA-related access issues that users can encounter. There are three likely scenarios. A user doesn’t have access to their MFA verification method and can’t log in. A user loses or replaces a verification method and must register a new one. And the connection between a user’s registered verification method and their Salesforce account stops working. Use temporary verification codes to allow users to regain access immediately. When dealing with a broken connection or a missing verification method, revoke the connection and help the user set up a new method. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
Available in: all editions
![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png) Important Salesforce enforces MFA requirements in the summer of 2026. See these articles for more information and detailed rollout timelines. - [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&type=1&language=en_US). - [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US). ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png) Important If you’re the only admin for your Salesforce org and you get locked out because of MFA, contact Salesforce Customer Support for help. Here are the recommended recovery steps for these MFA-related access issues. - [A user forgot their verification method and can’t log in](https://help.salesforce.com/s/articleView?id=xcloud.mfa_access_recovery.htm&release=264.0.0&type=5) - [A user lost their verification method or it was stolen](https://help.salesforce.com/s/articleView?id=xcloud.mfa_access_recovery.htm&release=264.0.0&type=5) - [A user’s verification method stopped working, or they replaced a method with a new one of the same type](https://help.salesforce.com/s/articleView?id=xcloud.mfa_access_recovery.htm&release=264.0.0&type=5) ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png) Note Make sure that you have the Manage Multi-Factor Authentication in User Interface permission in addition to your Salesforce admin permissions. You need this additional permission to generate temporary verification codes, disconnect verification methods from user accounts, and monitor identity verification and verification method activities in your org. See [Delegate MFA Management Tasks for Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_delegate_2fa_mgt_ui.htm&release=264.0.0&type=5 "Set up Salesforce admins, and trusted users who aren’t admins, to provide support for your org’s multi-factor authentication (MFA) implementation. For example, suppose you want your company’s Help Desk staff to assist admins by generating temporary verification codes for users who have lost or forgot their MFA verification methods. Assign the Manage Multi-Factor Authentication in User Interface user permission to all admins and anyone else who is supporting MFA, so they can generate codes and help end users with other MFA tasks."). ## User Forgot Their Verification Method If a user forgot to bring their security key or the device that has their authenticator app or service, a temporary verification code gets them through the day. - Issue the user a temporary verification code so they can log in. See [Generate a Temporary Verification Code for MFA Logins to Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_temp_id_verification_code_generate.htm&release=264.0.0&type=5 "If a user forgets or loses the identity verification method that they use for multi-factor authentication (MFA), generate a temporary verification code so they can log in while you sort out the issue. You can control how long codes are valid, up to 24 hours. A user can log in multiple times with their code until it expires. Temporary verification codes are valid for MFA only. They can’t be used for device activation, when a user must verify their identity because they’re logging in from an unrecognized browser or app."). - Expire the temporary verification code when it's no longer needed. See [Expire an MFA Temporary Verification Code for Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_temp_id_verification_code_expire.htm&release=264.0.0&type=5 "Expire a user’s temporary verification code when the user no longer needs it for multi-factor authentication (MFA)."). ## User's Verification Method Is Lost or Stolen Temporary verification codes allow a user to work until they’re able to replace their verification method. We also recommend several security-related steps to ensure a bad actor isn’t trying to use the missing method. - Remove the user’s current session and have the user reauthenticate. See [User Sessions](https://help.salesforce.com/articleView?id=security_user_session_info.htm&language=en_US). - Disconnect the user's existing verification method. See [Disconnect Identity Verification Methods that are Lost, Replaced, or Not Working (Salesforce Orgs)](https://help.salesforce.com/s/articleView?id=xcloud.security_disconnect_verification_methods.htm&release=264.0.0&type=5 "When addressing multi-factor authentication (MFA) access issues, there are situations where a Salesforce admin must disconnect a user’s current verification method from their Salesforce account. This step is necessary if a user has lost their method, or has acquired a replacement method that they want to use instead of their current one. If a user’s method stops working, disconnecting it allows the user to re-register the method and restore its connection to their account. It’s also a good practice to disconnect all of a user’s verification methods if they leave your company."). - Issue the user a temporary verification code so they can log in while you resolve their issue. See [Generate a Temporary Verification Code for MFA Logins to Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_temp_id_verification_code_generate.htm&release=264.0.0&type=5 "If a user forgets or loses the identity verification method that they use for multi-factor authentication (MFA), generate a temporary verification code so they can log in while you sort out the issue. You can control how long codes are valid, up to 24 hours. A user can log in multiple times with their code until it expires. Temporary verification codes are valid for MFA only. They can’t be used for device activation, when a user must verify their identity because they’re logging in from an unrecognized browser or app."). - Audit the user’s account to see if there’s been any unusual activity. See [How Your Users Are Verifying Their Identity](https://help.salesforce.com/articleView?id=security_monitor_verification_methods.htm&language=en_US). - Assist the user with acquiring a replacement device. When they have it, help them register their verification method or set up a new method. See [Help Users Register MFA Verification Methods for Direct Login](https://help.salesforce.com/s/articleView?id=xcloud.security_register_verification_methods.htm&release=264.0.0&type=5 "Multi-factor authentication (MFA) is required to access production and sandbox orgs. To log in, users must have at least one registered identity verification method that they provide in addition to their username and password. If they haven’t set up a verification method, they’re prompted to register one for MFA when they log in. The registration process connects a verification method to the user’s Salesforce account. Each user must complete this step themselves — Salesforce admins can’t do it for them. But you can head off confusion and support tickets but making sure your users understand what they must do."). - Expire the user's temporary verification code when it's no longer needed. See [Expire an MFA Temporary Verification Code for Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_temp_id_verification_code_expire.htm&release=264.0.0&type=5 "Expire a user’s temporary verification code when the user no longer needs it for multi-factor authentication (MFA)."). ## User's Verification Method Isn't Working or Has Been Replaced If a user’s verification method has stopped working correctly, reset the method so the user can re-register it for MFA. These steps also apply if a user updates their security key with a new device, or replaces their mobile device or computer and has to install an MFA authenticator on the new hardware. - Issue the user a temporary verification code so they can log in while you resolve their issue. See [Generate a Temporary Verification Code for MFA Logins to Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_temp_id_verification_code_generate.htm&release=264.0.0&type=5 "If a user forgets or loses the identity verification method that they use for multi-factor authentication (MFA), generate a temporary verification code so they can log in while you sort out the issue. You can control how long codes are valid, up to 24 hours. A user can log in multiple times with their code until it expires. Temporary verification codes are valid for MFA only. They can’t be used for device activation, when a user must verify their identity because they’re logging in from an unrecognized browser or app."). - Disconnect the user's existing verification method. This step is necessary because the user can’t register a replacement method of the same type until the current one is removed from Salesforce. See [Disconnect Identity Verification Methods that are Lost, Replaced, or Not Working (Salesforce Orgs)](https://help.salesforce.com/s/articleView?id=xcloud.security_disconnect_verification_methods.htm&release=264.0.0&type=5 "When addressing multi-factor authentication (MFA) access issues, there are situations where a Salesforce admin must disconnect a user’s current verification method from their Salesforce account. This step is necessary if a user has lost their method, or has acquired a replacement method that they want to use instead of their current one. If a user’s method stops working, disconnecting it allows the user to re-register the method and restore its connection to their account. It’s also a good practice to disconnect all of a user’s verification methods if they leave your company."). - Help the user re-register their verification method or set up a new method. See [Help Users Register MFA Verification Methods for Direct Login](https://help.salesforce.com/s/articleView?id=xcloud.security_register_verification_methods.htm&release=264.0.0&type=5 "Multi-factor authentication (MFA) is required to access production and sandbox orgs. To log in, users must have at least one registered identity verification method that they provide in addition to their username and password. If they haven’t set up a verification method, they’re prompted to register one for MFA when they log in. The registration process connects a verification method to the user’s Salesforce account. Each user must complete this step themselves — Salesforce admins can’t do it for them. But you can head off confusion and support tickets but making sure your users understand what they must do."). - Expire the user's temporary verification code when it's no longer needed. See [Expire an MFA Temporary Verification Code for Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_temp_id_verification_code_expire.htm&release=264.0.0&type=5 "Expire a user’s temporary verification code when the user no longer needs it for multi-factor authentication (MFA)."). - **[Generate a Temporary Verification Code for MFA Logins to Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_temp_id_verification_code_generate.htm&release=264.0.0&type=5)** If a user forgets or loses the identity verification method that they use for multi-factor authentication (MFA), generate a temporary verification code so they can log in while you sort out the issue. You can control how long codes are valid, up to 24 hours. A user can log in multiple times with their code until it expires. Temporary verification codes are valid for MFA only. They can’t be used for device activation, when a user must verify their identity because they’re logging in from an unrecognized browser or app. - **[Expire an MFA Temporary Verification Code for Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_temp_id_verification_code_expire.htm&release=264.0.0&type=5)** Expire a user’s temporary verification code when the user no longer needs it for multi-factor authentication (MFA). - **[Disconnect Identity Verification Methods that are Lost, Replaced, or Not Working (Salesforce Orgs)](https://help.salesforce.com/s/articleView?id=xcloud.security_disconnect_verification_methods.htm&release=264.0.0&type=5)** When addressing multi-factor authentication (MFA) access issues, there are situations where a Salesforce admin must disconnect a user’s current verification method from their Salesforce account. This step is necessary if a user has lost their method, or has acquired a replacement method that they want to use instead of their current one. If a user’s method stops working, disconnecting it allows the user to re-register the method and restore its connection to their account. It’s also a good practice to disconnect all of a user’s verification methods if they leave your company. #### See Also - [Generate a Temporary Verification Code for MFA Logins to Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_temp_id_verification_code_generate.htm&release=264.0.0&type=5 "If a user forgets or loses the identity verification method that they use for multi-factor authentication (MFA), generate a temporary verification code so they can log in while you sort out the issue. You can control how long codes are valid, up to 24 hours. A user can log in multiple times with their code until it expires. Temporary verification codes are valid for MFA only. They can’t be used for device activation, when a user must verify their identity because they’re logging in from an unrecognized browser or app.") - [Expire an MFA Temporary Verification Code for Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_temp_id_verification_code_expire.htm&release=264.0.0&type=5 "Expire a user’s temporary verification code when the user no longer needs it for multi-factor authentication (MFA).") - [Disconnect Identity Verification Methods that are Lost, Replaced, or Not Working (Salesforce Orgs)](https://help.salesforce.com/s/articleView?id=xcloud.security_disconnect_verification_methods.htm&release=264.0.0&type=5 "When addressing multi-factor authentication (MFA) access issues, there are situations where a Salesforce admin must disconnect a user’s current verification method from their Salesforce account. This step is necessary if a user has lost their method, or has acquired a replacement method that they want to use instead of their current one. If a user’s method stops working, disconnecting it allows the user to re-register the method and restore its connection to their account. It’s also a good practice to disconnect all of a user’s verification methods if they leave your company.")