---
schema_version: "1"
id: bdf090a69328c2d556d69ce4e8cb8a6b328e3d5e1c84f494fe111a40da2cee9a
title: Determine Business and User Needs for MFA
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_evaluate_requirements.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_evaluate_requirements.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 0607ea7d7eb4c4d1cce5b83c3049acee3b1db83beaccc38c036704cc714ccdba
description: Even though multi-factor authentication (MFA) is required to access production orgs and sandboxes, we recommend that you look for ways to optimize the experience for your users. If your company accesses Salesforce via single sign-on (SSO), understanding your business and user needs gives you insights to help define your MFA implementation. To help determine the most suitable MFA verification methods for your users, review potential requirements and important considerations.
products:
  - Security
release: "264"
---
# Determine Business and User Needs for MFA

Even though multi-factor authentication (MFA) is required to access production orgs and sandboxes, we recommend that you look for ways to optimize the experience for your users. If your company accesses Salesforce via single sign-on (SSO), understanding your business and user needs gives you insights to help define your MFA implementation. To help determine the most suitable MFA verification methods for your users, review potential requirements and important considerations.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png)

Important

Salesforce enforces MFA requirements in the summer of 2026. See these articles for more information and detailed rollout timelines.

- [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&type=1&language=en_US).
- [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US).

Here are some questions and potential requirements to consider.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:30.211480362537763%">
          <col style="width:69.78851963746223%">
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Existing Authentication Solutions</td>

            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Does your company use an existing MFA solution, like Okta or Duo, for other
                systems? If your Salesforce users already use MFA to log in to other applications,
                see whether you can integrate your Salesforce products with the same solution. Doing
                so can minimize friction and change management needs because users already use
                MFA.</p>
              <p style="margin-bottom:0;">Are your Salesforce products integrated with an SSO solution? If so, you
                can <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_thirdparty_idp.htm&amp;release=264.0.0&amp;type=5" title="With single sign-on (SSO), users log in to Salesforce from another site, like Google (the SSO identity provider). To help prevent unauthorized access to Salesforce accounts, you're required to use multi-factor authentication (MFA) when logging in via SSO. You can set up an SSO flow where users log in to the identity provider and complete MFA before they're redirected to Salesforce. To use this option, Salesforce requires your identity provider to send specific authentication signals that indicate the MFA method.">use your SSO provider's
                  MFA service</a> (provided that the provider sends the appropriate
                authentication signals to Salesforce). Or, you can <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_logins.htm&amp;release=264.0.0&amp;type=5" title="To help prevent unauthorized access to your account, Salesforce requires multi-factor authentication (MFA) when users log in via single sign-on (SSO). You can use the MFA service included in the Salesforce platform to satisfy this requirement. With this approach, when users log in to Salesforce, they're prompted to provide an MFA verification method to confirm their identity.">use the MFA service included with Salesforce to
                  satisfy the requirement</a>.</p>
            </td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Device Requirements</td>

            <td class="slds-cell-wrap" style="vertical-align:top;">Consider whether your industry's or company's mobile device policies place any
              constraints on your MFA implementation. For example, to satisfy the
              phishing-resistant MFA requirement for admin users, does your company allow hardware
              security keys? Or should you satisfy the requirement with passkeys built into users'
              devices, such as Touch ID or Windows Hello?</td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">User Considerations</td>

            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Understand how MFA can impact the various roles and teams at your company. For example:</p>
              <ul>
                <li>Which users need privileged access? These users are <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_phishing_resistant.htm&amp;release=264.0.0&amp;type=5" title="Salesforce requires multi-factor authentication (MFA) for all employee logins to Salesforce products. For internal user accounts that have a higher level of access, such as admin accounts, Salesforce requires extra security: users must complete MFA using a phishing-resistant method, such as a passkey or security key. This requirement applies to direct and single sign-on (SSO) logins for active production and sandbox orgs.">required to log in with
                    phishing-resistant MFA methods</a>.</li>

                <li>Do any of your users travel or work from locations with limited
                  connectivity?</li>

                <li>Do you have any users, such as third-party call center agents or employees
                  with accessibility requirements, who have additional needs or restrictions
                  regarding verification methods?</li>

                <li>Which verification methods are the least intrusive to your users'
                  workflow?</li>

              </ul>
              <p style="margin-bottom:0;">We recommend supporting multiple verification methods in your implementation,
                so that each person can choose the options that work best for them.</p>
            </td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Shared Salesforce Credentials</td>

            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Sharing user credentials with multiple users isn't allowed. MFA is incompatible
                with this practice because Salesforce requires each user to register and connect a unique verification
                method to their Salesforce account before they can log in. If multiple users in your
                org share a single account, only one person can log in when MFA is
                turned on.</p>
              <p style="margin-bottom:0;">Resolve any shared accounts or credentials that are in use. Make sure
                you have enough licenses to set up separate accounts for each person who accesses
                your Salesforce org. If you need help with setting up unique user accounts,
                contact your Account Executive or Sales team. Or refer to <a href="https://help.salesforce.com/s/articleView?id=000331055&amp;type=1&amp;language=en_US" target="_blank">Salesforce Checkout and Self Service to Manage
                  Your Account</a>.</p>
            </td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Budget and Timeline</td>

            <td class="slds-cell-wrap" style="vertical-align:top;">Consider your budget for operational and user support functions.
              Salesforce products provide MFA at no extra cost, and the Salesforce Authenticator
              app is free. But if a mobile app option doesn't work for some or all users, consider
              setting aside some budget to purchase and distribute security keys.</td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Security Requirements</td>

            <td class="slds-cell-wrap" style="vertical-align:top;">Make sure that you <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_understand_requirements.htm&amp;release=264.0.0&amp;type=5" title="To protect users from security threats such as phishing, credential stuffing, and account takeovers, Salesforce requires multi-factor authentication (MFA) for all employee logins to Salesforce products. Understand MFA requirements based on the type of org, the type of user, and the user's level of access.">understand MFA requirements for internal users</a>, including the <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_phishing_resistant.htm&amp;release=264.0.0&amp;type=5" title="Salesforce requires multi-factor authentication (MFA) for all employee logins to Salesforce products. For internal user accounts that have a higher level of access, such as admin accounts, Salesforce requires extra security: users must complete MFA using a phishing-resistant method, such as a passkey or security key. This requirement applies to direct and single sign-on (SSO) logins for active production and sandbox orgs.">phishing-resistant MFA requirement
                for privileged users</a>. Work with your security and IT teams to understand
              how MFA aligns with your company's security objectives and requirements. Understand
              whether any enterprise mandates are in place, and what kinds of application testing
              or evaluation processes you must follow.</td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Legal and Regulatory Requirements</td>

            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>What are your company's legal commitments to customers and other stakeholders
                around how your users authenticate to your systems? </p>
              <p style="margin-bottom:0;">Also consider local and other
                regulatory requirements and how they can impact your MFA implementation. For
                example, some regulatory requirements include restrictions on downloading
                applications to certain devices or bringing mobile devices into certain
                environments.</p>
            </td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Compliance Requirements</td>

            <td class="slds-cell-wrap" style="vertical-align:top;">What kinds of audit requirements does an MFA implementation affect or trigger?
              Are you beginning any new compliance regimes in the next 12 months that could be
              affected by your MFA implementation?</td>

          </tr>
        </tbody>
      </table>

#### See Also

- [MFA Verification Methods for Direct Salesforce Login](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods.htm&release=264.0.0&type=5 "The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce MFA functionality supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. You can control which methods are available to your users.")