---
schema_version: "1"
id: 0eafc6131dbcdbdb818c15828fbda8cf6ab4adafcd322b53af95477789cdb084
title: Register for Multi-Factor Authentication (or Get a Little More Time If You Need It)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_registration_post_grace_period.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_registration_post_grace_period.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 78b746587397c0a3cb57fd133edfeda5901caf6ddb22558f02a3cbf971873792
description: To protect your account against cyberthreats, logins now require multi-factor authentication (MFA) in addition to your username and password. To finish logging in, register a verification method that proves your identity. A Salesforce admin can temporarily disable MFA if users need more time to get ready.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Register for Multi-Factor Authentication (or Get a Little More Time If You Need It)

To protect your account against cyberthreats, logins now require multi-factor authentication (MFA) in addition to your username and password. To finish logging in, register a verification method that proves your identity. A Salesforce admin can temporarily disable MFA if users need more time to get ready.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-basics-264-0-0-production-enus/d8bf6981-f8ef-4f16-bfbd-c42ed32044eb/images/icon_important.png)

Important If you’re the only Salesforce admin for your org and you can’t log in because of MFA, contact Salesforce Customer Support to regain access.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-basics-264-0-0-production-enus/d8bf6981-f8ef-4f16-bfbd-c42ed32044eb/images/icon_note.png)

Note Not familiar with MFA? Check out this [video tutorial](https://salesforce.vidyard.com/watch/Zs9r7CyxF6Wu9rfNmMnmFf).

## Register an Identity Verification Method for MFA

Pick one of these verification methods, then follow the on-screen registration steps. Not sure which option to use and can’t log in because of it? Talk to your Salesforce admin.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:25%">
          <col style="width:25%">
          <col style="width:25%">
          <col style="width:25%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="text-align:center;vertical-align:middle;" id="d22943e57">Salesforce Authenticator</th>
            <th scope="col" class="slds-cell-wrap" style="text-align:center;vertical-align:middle;" id="d22943e60">Built-In Authenticator</th>
            <th scope="col" class="slds-cell-wrap" style="text-align:center;vertical-align:middle;" id="d22943e63">Security Key (U2F or WebAuthn)</th>
            <th scope="col" class="slds-cell-wrap" style="text-align:center;vertical-align:middle;" id="d22943e66">Third-Party Authenticator</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Salesforce Authenticator" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d22943e57 ">
              <ul>
                <li>A free mobile app from Salesforce</li>

                <li>Download on the <a href="https://itunes.apple.com/us/app/salesforce-authenticator/id782057975" target="_blank">App
                    Store</a> or <a href="https://play.google.com/store/apps/details?id=com.salesforce.authenticator" target="_blank">Google Play</a></li>

              </ul>
            </td>

            <td data-label="Built-In Authenticator" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d22943e60 ">
              <ul>
                <li>OS-level authentication with biometrics, via services such as Windows Hello or
                  Touch ID</li>

                <li>Must be configured on your computer or mobile device before you can register
                  this option</li>

              </ul>
            </td>

            <td data-label="Security Key (U2F or WebAuthn)" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d22943e63 ">
              <ul>
                <li>A physical device such as a YubiKey or Titan Security key</li>

                <li>Plugs into your computer — no mobile device needed</li>

              </ul>
            </td>

            <td data-label="Third-Party Authenticator" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d22943e66 ">
              <ul>
                <li>Apps that generate unique one-time codes, such as Google Authenticator or
                  Microsoft Authenticator</li>

                <li>Mobile, desktop, and browser extension apps are available</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Salesforce Authenticator" class="slds-cell-wrap" style="text-align:center;vertical-align:top;" headers="d22943e57 ">
              <p>
                <a href="https://help.salesforce.com/s/articleView?id=xcloud.salesforce_authenticator_overview.htm&amp;release=264.0.0&amp;type=5" title="Welcome to the Salesforce Authenticator mobile app. Salesforce Authenticator is the fastest and easiest way to complete multi-factor authentication (MFA) and other types of identity verification. Verify your identity with the tap of a finger while using any Salesforce product that requires MFA. You can also use the app with other online accounts that support time-based one-time password (TOTP) authenticator apps.">Learn
                  More</a>
              </p>
              <p style="margin-bottom:0;">
                <a href="https://help.salesforce.com/s/articleView?id=xcloud.salesforce_authenticator_add_account.htm&amp;release=264.0.0&amp;type=5" title="Connect your Salesforce account to the Salesforce Authenticator app so that you can easily log in with multi-factor authentication (MFA). Then, every time you log in to Salesforce, the app sends a notification to your mobile device to verify it’s you. The process for connecting your account depends on whether you’re logged in to Salesforce when MFA is enabled.">Registration
                  Help</a>
              </p>
            </td>

            <td data-label="Built-In Authenticator" class="slds-cell-wrap" style="text-align:center;vertical-align:top;" headers="d22943e60 ">
              <p>
                <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_bia.htm&amp;language=en_US" target="_blank">Learn
                  More</a>
              </p>
              <p style="margin-bottom:0;">
                <a href="https://help.salesforce.com/s/articleView?id=xcloud.register_built_in_authenticator.htm&amp;release=264.0.0&amp;type=5" title="For a secure, fast, and easy login with multi-factor authentication (MFA), create a passkey, also known as a built-in authenticator. With passkeys, you have multiple ways to log in: fingerprint or facial scanners on your device, physical security keys, a device PIN or password, or password managers. Some passkeys work only on the device where you set them up. If you set up a device-bound passkey on your laptop, you can’t use it to log in from your phone. If you log in to Salesforce from multiple devices, set up your passkeys so that you can access your account anywhere.">Registration Help</a>
              </p>
            </td>

            <td data-label="Security Key (U2F or WebAuthn)" class="slds-cell-wrap" style="text-align:center;vertical-align:top;" headers="d22943e63 ">
              <p>
                <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_securitykey.htm&amp;language=en_US" target="_blank">Learn
                  More</a>
              </p>
              <p style="margin-bottom:0;">
                <a href="https://help.salesforce.com/s/articleView?id=xcloud.security_u2f_register_security_key.htm&amp;release=264.0.0&amp;type=5" title="Register a physical security key so you can use it to verify your identity when logging in with multi-factor authentication (MFA) or if you receive a device activation challenge. You can use security keys that support the WebAuthn (FIDO2) or Universal Second Factor (U2F) standards. The registration process sets up your security key as a personal verification by creating a connection between your Salesforce account and the key. If you don’t see this option, talk to your Salesforce admin about enabling it.">Registration Help</a>
              </p>
            </td>

            <td data-label="Third-Party Authenticator" class="slds-cell-wrap" style="text-align:center;vertical-align:top;" headers="d22943e66 ">
              <p>
                <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_totp.htm&amp;language=en_US" target="_blank">Learn
                  More</a>
              </p>
              <p style="margin-bottom:0;">
                <a href="https://help.salesforce.com/s/articleView?id=xcloud.add_time-based_token.htm&amp;release=264.0.0&amp;type=5" title="Register a third-party authenticator app so you can use it to verify your identity when logging in with multi-factor authentication (MFA) or if you receive a device activation challenge. Authenticator apps, such as Google Authenticator, Microsoft Authenticator, or Authy, generate verification codes that you enter in Salesforce to verify your identity. There are mobile apps, browser extensions, and desktop options such as most password managers. You can use any third-party product that generates time-based one-time password (TOTP) codes. The registration process sets up your authenticator app as a personal verification method by creating a connection between your Salesforce account and the app.">Registration Help</a>
              </p>
            </td>

          </tr>
        </tbody>
      </table>

The registration process starts differently depending on your org. You see either a list of verification methods or you start with the option to connect Salesforce Authenticator.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="text-align:center;vertical-align:top;">
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="width:320px;margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-basics-264-0-0-production-enus/d8bf6981-f8ef-4f16-bfbd-c42ed32044eb/basics/images/mfa-verifier-list-post-grace-period.png" alt="Screenshot of the Choose a Verification Method screen for MFA registration"></span>
            </td>

            <td class="slds-cell-wrap" style="text-align:center;vertical-align:top;">
              <span style="vertical-align:text-bottom;display:inline-block;"><img style="width:320px;margin-bottom:0;" src="https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-basics-264-0-0-production-enus/d8bf6981-f8ef-4f16-bfbd-c42ed32044eb/basics/images/mfa-registration-prompt-highlighted-post-grace-period.png" alt="Connect Salesforce Authenticator screen for MFA registration with a highlight on the link for picking a different method"></span>
            </td>

            <td class="slds-cell-wrap" style="vertical-align:top;">&nbsp;</td>

          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="text-align:center;vertical-align:top;">
              <p style="margin-bottom:0;">Not seeing the last two options in the list? Ask your Salesforce admin to add
                them.</p>
            </td>

            <td class="slds-cell-wrap" style="text-align:center;vertical-align:top;">
              <p style="margin-bottom:0;">Don’t want to use Salesforce Authenticator? Select the highlighted link.</p>
            </td>

            <td class="slds-cell-wrap" style="vertical-align:top;">&nbsp;</td>

          </tr>
        </tbody>
      </table>

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-basics-264-0-0-production-enus/d8bf6981-f8ef-4f16-bfbd-c42ed32044eb/images/icon_tip.png)

Tip Registering Salesforce Authenticator? If you see six-digit codes in the app, you registered a different account at another time. For the account you’re logging into now, generate the required two-word phrase by tapping **Add an Account** in Salesforce Authenticator.

## Not Ready for MFA Yet? Salesforce Admins Can Temporarily Disable It

If you’re a Salesforce admin and your users need more time to get ready for MFA, you can temporarily disable it for your org. From Setup, in the Quick Find box, enter Identity, and then select **Identity Verification**. Deselect **Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org**, then save your changes.

Turning off MFA means you’re no longer complying with the contractual requirement to use it. Re-enable it as soon as possible. All admins for the org receive periodic in-app warnings until MFA is turned on again. For full details about the MFA requirement, see the [Salesforce Multi-Factor Authentication FAQ](https://help.salesforce.com/apex/HTViewSolution?urlname=Salesforce-Multi-Factor-Authentication-FAQ).