--- schema_version: "1" id: 4e0a0c68dd297446a86f88624aaf66fe07262766fc69a12fdab47cf20e2168d9 title: Configure the MFA Verification Methods Available to Your Users for Salesforce Orgs collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_config_available_verifiers.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_config_available_verifiers.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 927318d82d59cc929ef888d7c496ebebdfe5aca7e60847af912201a4847fcfdd description: "Salesforce supports four identity verification methods for multi-factor authentication (MFA) and device activation: built-in authenticators, physical security keys, Salesforce Authenticator, and third-party authenticator apps. As a security best practice, require users to use phishing-resistant methods: built-in authenticators or security keys. In orgs created before Summer ’25, Salesforce Authenticator and third-party apps are automatically available to users, but a Salesforce admin must enable the options to use passkeys (built-in authenticators and physical security keys). In orgs created in Summer ’25 and later, all verification methods are allowed by default. For external users only, you can allow the use of one-time passcodes delivered via SMS text messages." products: - Security release: "264" --- # Configure the MFA Verification Methods Available to Your Users for Salesforce Orgs Salesforce supports four identity verification methods for multi-factor authentication (MFA) and device activation: built-in authenticators, physical security keys, Salesforce Authenticator, and third-party authenticator apps. As a security best practice, require users to use phishing-resistant methods: built-in authenticators or security keys. In orgs created before Summer ’25, Salesforce Authenticator and third-party apps are automatically available to users, but a Salesforce admin must enable the options to use passkeys (built-in authenticators and physical security keys). In orgs created in Summer ’25 and later, all verification methods are allowed by default. For external users only, you can allow the use of one-time passcodes delivered via SMS text messages. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
Available in: all editions
![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png) Important Salesforce enforces MFA requirements in the summer of 2026. See these articles for more information and detailed rollout timelines. - [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&type=1&language=en_US). - [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US). - **[Enable Passkeys for Identity Verification in Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_enable_builtin_authenticator.htm&release=264.0.0&type=5)** With passkeys, users can log in and complete multi-factor authentication (MFA) with Touch ID or Face ID, Windows Hello, a device password, or password managers. With MFA enforcement, Salesforce automatically enables passkeys (also known as built-in authenticators) as an available verification method for all employee users. When MFA is enforced in your org, you can't turn off this setting. If MFA isn't enforced yet in your org, turn on passkeys to test them. Passkeys satisfy the phishing-resistant MFA requirement for privileged users. Users can also use security keys to complete other identity verification challenges, such as device activation. - **[Enable Security Keys for Identity Verification in Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_u2f_enable.htm&release=264.0.0&type=5)** Security keys are small physical devices, such as YubiKeys or Titan keys, that users can use to set up passkeys for secure multi-factor authentication (MFA). With MFA enforcement, Salesforce automatically enables security keys as an available verification method for all employee users. When MFA is enforced in your org, you can't turn off this setting. If MFA isn't enforced yet in your org, turn on security keys to test them. Security keys satisfy the phishing-resistant MFA requirement for users with privileged permissions. Users can also use security keys to complete other identity verification challenges, such as device activation. - **[Use SMS as an MFA Verification Method for External Users](https://help.salesforce.com/s/articleView?id=xcloud.security_mfa_sms_for_external_users.htm&release=264.0.0&type=5)** If you enable multi-factor authentication (MFA) for your customer or partner Experience Cloud sites, external users can log in using one-time passcodes delivered via SMS text messages. Users need only a verified mobile number and access to their device when they log in. This option is available for external users only. External users can also verify their identity with other supported MFA verification methods such as Salesforce Authenticator built-in authenticators, security keys, and third-party authenticator apps. #### See Also - [Troubleshoot Passkey Issues](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_bia.htm&release=264.0.0&type=5 "When employee users log in and register for multi-factor authentication (MFA), passkeys are the default option. Identify and resolve issues with passkey prompts, setup, login, and more.") - [Security Keys (Passkeys) for MFA](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_securitykey.htm&release=264.0.0&type=5 "Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users.") - [MFA Verification Methods for Direct Salesforce Login](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods.htm&release=264.0.0&type=5 "The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce MFA functionality supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. You can control which methods are available to your users.")