---
schema_version: "1"
id: e64a2adadebe0dbb847f01997bdf104a2e26ed7404e22494e6859f75aeac1be4
title: Enable MFA for External Experience Cloud Site Users (or Specific Internal Users)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_direct_login_user_perm.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_direct_login_user_perm.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 40c3361feac77212fe3a3f371b677687086cad361500fbdb47a576692160d967
description: Salesforce doesn’t require multi-factor authentication (MFA) for external users but you can certainly include this class of users in your MFA implementation. To enable MFA for external users who log in directly to your company’s Experience Cloud sites, employee communities, or other types of community portals, apply the Multi-Factor Authentication for User Interface Logins user permission. You can also use the MFA user permission to enable MFA for specific internal users. When MFA is turned on, users logging in directly with their username and password must also provide an identity verification method such as an authenticator app or security key.
products:
  - Security
release: "264"
---
# Enable MFA for External Experience Cloud Site Users (or Specific Internal Users)

Salesforce doesn’t require multi-factor authentication (MFA) for external users but you can certainly include this class of users in your MFA implementation. To enable MFA for external users who log in directly to your company’s Experience Cloud sites, employee communities, or other types of community portals, apply the Multi-Factor Authentication for User Interface Logins user permission. You can also use the MFA user permission to enable MFA for specific internal users. When MFA is turned on, users logging in directly with their username and password must also provide an identity verification method such as an authenticator app or security key.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both <strong>Salesforce Classic</strong> (<a href="https://help.salesforce.com/s/articleView?id=overview_edition_lex_only.htm&amp;language=en_US&amp;type=5" target="_blank">not available in all orgs</a>) and <strong>Lightning Experience</strong></td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d70278e65">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d70278e65 ">To edit profiles and permission sets:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d70278e65 ">Manage Profiles and Permission Sets</td>

          </tr>
        </tbody>
      </table>

To enable MFA for external Experience Cloud site users:

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **Profiles**.
2. Edit the custom profiles assigned to external Experience Cloud site users. (Standard profiles can’t be edited.)
3. In the General User Permissions section, select the **Multi-Factor Authentication for User Interface Logins** checkbox.
4. Save your change.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png)

Note

The Multi-Factor Authentication for User Interface Logins user permission can also be used to enable MFA for direct logins by specific internal users. This method is useful for testing an MFA rollout in a trial, sandbox, or dev org. The setup process is the same as shown in this topic except you can assign the user permission by a permission set instead of editing customer profiles. See [Create Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_create.htm&type=5&language=en_US), [Enable User Permissions in Permission Sets](https://help.salesforce.com/s/articleView?id=platform.perm_sets_app_perms.htm&type=5&language=en_US), and [Manage Permission Set Assignments](https://help.salesforce.com/s/articleView?id=platform.perm_sets_manage_assignments.htm&type=5&language=en_US) for guidance. (The permission set option doesn’t apply for external users.)

Because Salesforce automatically enables MFA for all internal users who log in directly to production orgs, the MFA user permission is no longer necessary or useful in those environments.

You can’t assign the Multi-Factor Authentication for User Interface Logins permission to users with the Salesforce Limited Access – Free license. We're working to resolve this issue.

#### See Also

- [Profiles](https://help.salesforce.com/s/articleView?id=platform.admin_userprofiles.htm&type=5&language=en_US)
- [Use SMS as an MFA Verification Method for External Users](https://help.salesforce.com/s/articleView?id=xcloud.security_mfa_sms_for_external_users.htm&release=264.0.0&type=5 "If you enable multi-factor authentication (MFA) for your customer or partner Experience Cloud sites, external users can log in using one-time passcodes delivered via SMS text messages. Users need only a verified mobile number and access to their device when they log in. This option is available for external users only. External users can also verify their identity with other supported MFA verification methods such as Salesforce Authenticator built-in authenticators, security keys, and third-party authenticator apps.")
- [Exclude Exempt Users from MFA for Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_mfa_exclude_exempt_users.htm&release=264.0.0&type=5 "The Waive Multi-Factor Authentication for Exempt Users user permission previously allowed you to exempt specific users from MFA for use cases such as automation. After Salesforce enforces MFA requirements in your org, this permission no longer automatically exempts users from MFA. To restore this exemption for valid use cases, you must contact Salesforce Customer Support.")
- [Enable MFA for Direct Login](https://help.salesforce.com/s/articleView?id=xcloud.security_mfa_org_wide_setting.htm&release=264.0.0&type=5 "Turn on multi-factor authentication (MFA) for everyone in your org with a single setting. When MFA is enabled, all internal users logging in directly with their username and password must also provide an identity verification method, such as an authenticator app or security key.")
- [Test Your MFA Implementation for Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.mfa_test.htm&release=264.0.0&type=5 "If you test MFA ahead of time, you gain experience with the MFA registration process and can assist users with login issues. Even if Salesforce automatically enabled MFA for your existing org, it’s beneficial to evaluate how things work in a test environment.")