---
schema_version: "1"
id: 32405161d335b818b94052ed32413da9b523134a41d6870fc1a2e5dfabaa1d81
title: Use Salesforce MFA for SSO (Salesforce Orgs)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_sso_logins.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_logins.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 445a3d624f86aee730e4a4e5ba024058c274c57f282e2bd268fc86c9730c4dd2
description: To help prevent unauthorized access to your account, Salesforce requires multi-factor authentication (MFA) when users log in via single sign-on (SSO). You can use the MFA service included in the Salesforce platform to satisfy this requirement. With this approach, when users log in to Salesforce, they're prompted to provide an MFA verification method to confirm their identity.
products:
  - Security
release: "264"
---
# Use Salesforce MFA for SSO (Salesforce Orgs)

To help prevent unauthorized access to your account, Salesforce requires multi-factor authentication (MFA) when users log in via single sign-on (SSO). You can use the MFA service included in the Salesforce platform to satisfy this requirement. With this approach, when users log in to Salesforce, they're prompted to provide an MFA verification method to confirm their identity.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png)

Important

Salesforce enforces MFA requirements in the summer of 2026. See these articles for more information and detailed rollout timelines.

- [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&type=1&language=en_US).
- [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US).

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d119912e79">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d119912e79 ">To edit SAML settings:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d119912e79 ">Customize Application AND Modify All Data</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d119912e79 ">To edit Auth Providers:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d119912e79 ">Customize Application AND Manage Auth. Providers</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d119912e79 ">To edit session security settings:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d119912e79 ">Customize Application</td>

          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png)

Note

Prior to Summer '23, the way to use Salesforce MFA for SSO logins was by applying a high-assurance session security requirement to user profiles. For improved functionality, including Visualforce compatibility, we recommend switching to the method shown in this help topic. For guidance on how to remove the old method, see [_Knowledge Article_: Reset Session Security Settings for Your Salesforce MFA for SSO Configuration](https://help.salesforce.com/s/articleView?id=000395202&type=1&language=en_US).

To use Salesforce MFA for new or existing SSO configurations:

1. Enable MFA for your users.
    
    Salesforce automatically enables MFA for all users in production orgs. If that's not the case for your org, see [Enable MFA for Your Entire Org](https://help.salesforce.com/s/articleView?id=xcloud.security_mfa_org_wide_setting.htm&release=264.0.0&type=5 "Turn on multi-factor authentication (MFA) for everyone in your org with a single setting. When MFA is enabled, all internal users logging in directly with their username and password must also provide an identity verification method, such as an authenticator app or security key.").
2. Enable MFA for your SSO configuration.
    
    On the setup page for your SAML or Auth Provider SSO configuration, enable the **Use Salesforce MFA for this SSO Provider** setting. If you use multiple SSO configurations for logins to Salesforce, do this step for each configuration.
3. Ensure that your session security level settings are correctly configured.
    1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), in the Quick Find Box, enter Session Settings, and select Session Settings.
    2. In Session Security Levels, make sure that your SSO provider is in the Standard column and Multi Factor Authentication is in the High-Assurance column.
        
        This setup ensures that your SSO users receive a high-assurance session only if they complete MFA.
    3. Save your changes.

If you're creating a new SSO configuration, see these resources for help with the setup process.

- [SAML SSO with Salesforce as the Service Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_setting_up.htm&release=264.0.0&type=5 "SAML is an open-standard authentication protocol that Salesforce uses for single sign-on (SSO) into a Salesforce org from a third-party identity provider. You can also use SAML to automatically create user accounts with Just-in-Time (JIT) user provisioning.")
- [Authentication Provider SSO with Salesforce as the Relying Party](https://help.salesforce.com/s/articleView?id=xcloud.sso_authentication_providers.htm&release=264.0.0&type=5 "With authentication providers, your users can log in to your Salesforce org or Experience Cloud site with single sign-on (SSO) using credentials from a third party. Authentication providers also give your users access to protected third-party data. Salesforce offers several ways to configure authentication providers, such as with OpenID Connect or with a custom OAuth 2.0 configuration. Which protocol you can use depends on the third party.")

#### See Also

- [MFA with an SSO Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_thirdparty_idp.htm&release=264.0.0&type=5 "With single sign-on (SSO), users log in to Salesforce from another site, like Google (the SSO identity provider). To help prevent unauthorized access to Salesforce accounts, you're required to use multi-factor authentication (MFA) when logging in via SSO. You can set up an SSO flow where users log in to the identity provider and complete MFA before they're redirected to Salesforce. To use this option, Salesforce requires your identity provider to send specific authentication signals that indicate the MFA method.")