---
schema_version: "1"
id: 501c4954a81c6e12c6efd52958cdae8d3bc56274d9a9cc35e432567bb0143e00
title: Multi-Factor Authentication (MFA) for Single Sign-On (SSO)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_for_single_sign_on.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_for_single_sign_on.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: df60ae41b9bafca65bddb933849be89c4057b325ee6f7c92ff0b26cc378242b5
description: With single sign-on (SSO), users log in to Salesforce from another site, like Google (the SSO provider). To secure these logins, Salesforce requires users to prove their identity with multi-factor authentication (MFA). You can satisfy MFA requirements by using your SSO provider's MFA service, provided that your SSO provider sends the right authentication signals to Salesforce. Alternatively, you can use the MFA functionality provided by Salesforce.
products:
  - Security
release: "264"
---
# Multi-Factor Authentication (MFA) for Single Sign-On (SSO)

With single sign-on (SSO), users log in to Salesforce from another site, like Google (the SSO provider). To secure these logins, Salesforce requires users to prove their identity with multi-factor authentication (MFA). You can satisfy MFA requirements by using your SSO provider's MFA service, provided that your SSO provider sends the right authentication signals to Salesforce. Alternatively, you can use the MFA functionality provided by Salesforce.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

- **[MFA with an SSO Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_thirdparty_idp.htm&release=264.0.0&type=5)**  
    With single sign-on (SSO), users log in to Salesforce from another site, like Google (the SSO identity provider). To help prevent unauthorized access to Salesforce accounts, you're required to use multi-factor authentication (MFA) when logging in via SSO. You can set up an SSO flow where users log in to the identity provider and complete MFA before they're redirected to Salesforce. To use this option, Salesforce requires your identity provider to send specific authentication signals that indicate the MFA method.
- **[Set Up MFA with an SSO Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_use_thirdparty_steps.htm&release=264.0.0&type=5)**  
    With single sign-on (SSO), users log in to Salesforce from another site, like Google (the SSO identity provider). Salesforce requires multi-factor authentication (MFA) when logging in via SSO. Here's how you can use your SSO identity provider's MFA service to satisfy the requirement. With this SSO flow, users log in to the identity provider and complete MFA before they're redirected to Salesforce.
- **[Use Salesforce MFA for SSO (Salesforce Orgs)](https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_logins.htm&release=264.0.0&type=5)**  
    To help prevent unauthorized access to your account, Salesforce requires multi-factor authentication (MFA) when users log in via single sign-on (SSO). You can use the MFA service included in the Salesforce platform to satisfy this requirement. With this approach, when users log in to Salesforce, they're prompted to provide an MFA verification method to confirm their identity.