--- schema_version: "1" id: acca8f811f60ea40077d95fb976390ec0fd59375228b634ffa95ae218405f386 title: Recognize Passkey Creation Prompt Behavior collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_passkeys_prompts_understand.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_passkeys_prompts_understand.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 510b90544a83df7f797014f4f9c00dda9ad6ada92fcd36e9342acb7273757447 description: Users see prompts to create a passkey in several situations, including after a sandbox refresh. The “Waive Multi-Factor Authentication for Exempt Users” permission applies only to customers with an active temporary extension for multi-factor authentication (MFA) enforcement. products: - Security release: "264" --- # Recognize Passkey Creation Prompt Behavior Users see prompts to create a passkey in several situations, including after a sandbox refresh. The “Waive Multi-Factor Authentication for Exempt Users” permission applies only to customers with an active temporary extension for multi-factor authentication (MFA) enforcement. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
Available in: all editions
## When Users See “Create a Passkey” Prompts With MFA enforcement, Salesforce requires employee users who don’t meet MFA requirements to register an MFA verification method. Salesforce defaults to a passkey-first MFA registration flow for all employee users. Salesforce requires users with privileged permissions to set up passkeys or another phishing-resistant MFA method. Users who don’t have privileged permissions still see the passkey prompt first, but they can choose to set up other MFA verification methods. Users with privileged permissions see this prompt when they log in directly. ![Create a Passkey prompt during direct login](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/security/images/mfa/troubleshooting_passkey_prompt_admins.png) Users with privileged permissions see this prompt when they log in through a single sign-on (SSO) identity provider that doesn’t satisfy Salesforce MFA requirements. ![Create a Passkey prompt during SSO login](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/security/images/mfa/troubleshooting_passkey_prompt_admin_sso.png) Users without privileged permissions see this prompt. They can click **Choose Another Verification Method** to set up Salesforce Authenticator or a third-party authenticator app instead. However, passkeys are still the first option shown to all users in the MFA registration flow. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png) Note The **Choose Another Verification Method** option isn’t available to users with privileged permissions. ![Create a Passkey prompt with other verification method options](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/security/images/mfa/passkey_non_admin_choice.png) ## Configure Passkeys After a Sandbox Refresh After a sandbox refresh, users are prompted to create a passkey, even if they had one set up already. Newly refreshed sandboxes don’t inherit all verification settings from the production environment. - Direct login and SSO: Users who had a passkey in production can see prompts to re-register in the refreshed sandbox until they complete the flow at least one time. Alternatively, they see a prompt to use their registered passkey, but the passkey doesn’t work. - SSO only: [Sandbox refreshes don’t fully inherit Security Assertion Markup Language (SAML) SSO configurations](https://help.salesforce.com/s/articleView?id=000385851&type=1&language=en_US). When users see these prompts, the required action varies based on the user’s login method. - Direct-login users: Follow the prompts at login to register a new passkey in the sandbox. If the sandbox prompts you to use your previously registered passkey and the passkey doesn’t work, [get access to your account without a passkey](https://help.salesforce.com/s/articleView?id=xcloud.mfa_passkey_account_lockout.htm&release=264.0.0&type=5 "Regain access to Salesforce if passkey issues prevent you from logging in."). Then [disconnect your current passkey and add a new passkey](https://help.salesforce.com/s/articleView?id=xcloud.mfa_passkeys_manage.htm&language=en_US). - SSO users: Create a passkey to log in, or [get access to your account without a passkey](https://help.salesforce.com/s/articleView?id=xcloud.mfa_passkey_account_lockout.htm&release=264.0.0&type=5 "Regain access to Salesforce if passkey issues prevent you from logging in."). Then re-enable SAML in the refreshed sandbox. See [SSO (Single Sign-On) SAML Settings Behavior During Sandbox Refresh — What Is Copied and What Changes](https://help.salesforce.com/s/articleView?id=000385851&type=1&language=en_US). ## Passkey Prompts for Users with the ‘Waive Multi-Factor Authentication for Exempt Users’ Permission After MFA enforcement, users who previously had the ‘Waive Multi-Factor Authentication for Exempt Users’ permission see prompts to create a passkey. MFA enforcement causes this behavior. Unless your company has an approved temporary extension to use this user permission, this user permission no longer exempts users from MFA after enforcement. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png) Note Unless your company has an approved temporary extension, the PermissionsBypassMFAForUiLogins API field for the “Waive Multi-Factor Authentication for Exempt Users” user permission is removed from the permission set and Profile object schema. After Salesforce removes the field, references to PermissionsBypassMFAForUiLogins can cause compilation errors that can block package installations or upgrades. Audit your code and metadata and remove all references to this field. For more information about MFA behavior with extensions, see [MFA and Phishing-Resistant MFA Post-Enforcement Passkey Prompts and Extension Behavior](https://help.salesforce.com/s/articleView?id=005388907&type=1&language=en_US). #### See Also - [Troubleshoot Passkey Issues](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_bia.htm&release=264.0.0&type=5 "When employee users log in and register for multi-factor authentication (MFA), passkeys are the default option. Identify and resolve issues with passkey prompts, setup, login, and more.")