--- schema_version: "1" id: 259703115d3dc64dbb74ba67204ae9c6d9888bbbaabe9feea9dd4a1b06cad4fd title: Phishing-Resistant MFA Requirement for Privileged Users collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_phishing_resistant.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_phishing_resistant.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: bb45df90478affdfa7be2490cc41047f076415a01b8008a6cee929ce575a0921 description: "Salesforce requires multi-factor authentication (MFA) for all employee logins to Salesforce products. For internal user accounts that have a higher level of access, such as admin accounts, Salesforce requires extra security: users must complete MFA using a phishing-resistant method, such as a passkey or security key. This requirement applies to direct and single sign-on (SSO) logins for active production and sandbox orgs." products: - Security release: "264" --- # Phishing-Resistant MFA Requirement for Privileged Users Salesforce requires multi-factor authentication (MFA) for all employee logins to Salesforce products. For internal user accounts that have a higher level of access, such as admin accounts, Salesforce requires extra security: users must complete MFA using a phishing-resistant method, such as a passkey or security key. This requirement applies to direct and single sign-on (SSO) logins for active production and sandbox orgs. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
Available in: all editions
Phishing is a social engineering technique used to acquire sensitive information. Phishers masquerade as a trustworthy person or company and convince users to give away sensitive information. For example, phishers convince users to enter their password on a fake website. Phishing-resistant MFA methods prevent these attacks because they're bound to one website, the domain for your Salesforce org. They can't be used on a phisher's illegitimate website. Phishing-resistant methods include passkeys, which let users log in with Touch or Face ID, Windows Hello, password managers, or security keys. For the phishing-resistant requirement, an internal user is considered privileged if they meet any of these criteria: - System Administrator profile OR - Author Apex user permission OR - Customize Application user permission OR - Modify All Data user permission OR - View All Data user permission For direct logins, Salesforce requires these users to complete MFA using a passkey ([built-in authenticator](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_bia.htm&release=264.0.0&type=5 "When employee users log in and register for multi-factor authentication (MFA), passkeys are the default option. Identify and resolve issues with passkey prompts, setup, login, and more.") or [security key](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_securitykey.htm&release=264.0.0&type=5 "Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users.")). With the enforcement of phishing-resistant MFA, privileged users who don't have a passkey are prompted to set one up to log in. To save time and clicks, you can also enable [passwordless login with passkeys](https://help.salesforce.com/s/articleView?id=xcloud.identity_passkey_login.htm&language=en_US), which allows users to log in with just their username and passkey. This is the fastest and easiest way to log in to Salesforce directly. For SSO logins, you can meet the requirement by using a phishing-resistant method from your SSO provider. For example, if your SSO provider is Okta, users can log in and complete MFA in Okta before being redirected to Salesforce. To use this option, your SSO provider must send properly formatted authentication signals that Salesforce recognizes as phishing-resistant. Otherwise, users are required to create a passkey before they can finish logging in to Salesforce. See [MFA with an SSO Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_thirdparty_idp.htm&release=264.0.0&type=5 "With single sign-on (SSO), users log in to Salesforce from another site, like Google (the SSO identity provider). To help prevent unauthorized access to Salesforce accounts, you're required to use multi-factor authentication (MFA) when logging in via SSO. You can set up an SSO flow where users log in to the identity provider and complete MFA before they're redirected to Salesforce. To use this option, Salesforce requires your identity provider to send specific authentication signals that indicate the MFA method."). Phishing-resistant MFA doesn't work with automation or integration user accounts. Consider removing permissions if possible and [completing MFA challenges programmatically with a third-party authenticator app](https://help.salesforce.com/s/articleView?id=xcloud.mfa_automation_totp.htm&release=264.0.0&type=5 "Salesforce requires multi-factor authentication (MFA) for all UI logins, including logins from automation users. For automation use cases such as Robotic Process Automation (RPA), you can programmatically complete MFA using third-party authenticator apps that generate time-based one-time passwords (TOTPs)."). For use cases that require automation users to have privileged permissions, contact Salesforce Customer Support. Phishing-resistant MFA is required only for users who access the Salesforce user interface (UI). It isn't required for API logins. ## Enforcement Timeline Salesforce enforces phishing-resistant MFA in the summer of 2026. For detailed rollout timelines, see [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US).