---
schema_version: "1"
id: 9a11a619e2740b1da020d0a5f92fcf8eb344bea8eb5b68da73a77f655b93569b
title: Set Up MFA with an SSO Identity Provider
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_sso_use_thirdparty_steps.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_use_thirdparty_steps.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 55e58f0d9530023cc3e1bb0072fd5752e304182634fd24d8a570a7514b61da18
description: With single sign-on (SSO), users log in to Salesforce from another site, like Google (the SSO identity provider). Salesforce requires multi-factor authentication (MFA) when logging in via SSO. Here's how you can use your SSO identity provider's MFA service to satisfy the requirement. With this SSO flow, users log in to the identity provider and complete MFA before they're redirected to Salesforce.
products:
  - Security
release: "264"
---
# Set Up MFA with an SSO Identity Provider

With single sign-on (SSO), users log in to Salesforce from another site, like Google (the SSO identity provider). Salesforce requires multi-factor authentication (MFA) when logging in via SSO. Here's how you can use your SSO identity provider's MFA service to satisfy the requirement. With this SSO flow, users log in to the identity provider and complete MFA before they're redirected to Salesforce.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:left;vertical-align:top;" id="d59949e60">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d59949e60 ">To view SSO settings:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d59949e60 ">View Setup and Configuration</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d59949e60 ">To edit SSO settings:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d59949e60 ">
              <p>Customize Application </p>
              <p style="margin-bottom:0;">AND</p>
              <p style="margin-bottom:0;">Modify All Data</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d59949e60 ">To monitor logins:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d59949e60 ">
              <p>Monitor Login History</p>
              <p>OR</p>
              <p style="margin-bottom:0;">Manage Users</p>
            </td>

          </tr>
        </tbody>
      </table>

To use your SSO provider's MFA service, your provider must send supported Authentication Methods References (AMR) or Authentication Context Class Reference (ACR) values. For a deeper explanation of what this means and how it works, see Overview: MFA with an SSO Identity Provider.

1. Determine what MFA method strength Salesforce requires for the user.
    - Privileged users (System Administrator profile or the Author Apex, Customize Application, Modify All Data, or View All Data user permissions)—phishing-resistant MFA methods are required.
    - Non-privileged users (anyone who doesn't have privileged permissions)—either phishing-resistant or standard methods can satisfy the MFA requirement.
2. Review supported AMR and ACR values for the user's level of access by going to [this knowledge artice](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US) and searching for Authentication Strength Tiers.
3. Work with your SSO identity provider to send a supported value to Salesforce. This step depends on your identity provider.
    
    ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_tip.png)
    
    Tip If you already have MFA set up, it's possible that your SSO provider sends a supported value to Salesforce. Use the instructions in step 4 to check.
4. Confirm that Salesforce receives the signals correctly.
    1. Log in to Salesforce from the SSO provider.
    2. From Setup, in the Quick Find box, enter Login, and then select **Login History**.
    3. Click **Create New View**.
    4. Follow the steps to name the view and to select filter criteria.
    5. For Select Fields to Display, add **Authentication Context Class Reference** or **Authentication Method Reference** to Selected Fields.
    6. Save the view.
    7. Look for an entry for your recent SSO login. Confirm that the value in the **Authentication Context Class Reference** or **Authentication Method Reference** field matches a supported value for the type of user.