---
schema_version: "1"
id: 5365c3c77b7127160a83539913a60b85177dc8626b87d3bbd1d79a283401c6bc
title: MFA Verification Methods for Direct Salesforce Login
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_supported_verification_methods.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: d12ebbbd4a3322909dca49c6466baea807380bc30b96e0a392c93b0c7c219b55
description: The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce MFA functionality supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. You can control which methods are available to your users.
products:
  - Security
release: "264"
---
# MFA Verification Methods for Direct Salesforce Login

The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce MFA functionality supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. You can control which methods are available to your users.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png)

Important

Salesforce enforces MFA requirements in the summer of 2026. See these articles for more information and detailed rollout timelines.

- [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&type=1&language=en_US).
- [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US).

Let's look at the benefits and considerations for each type of verification method supported by Salesforce products.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:25%">
          <col style="width:25%">
          <col style="width:25%">
          <col style="width:25%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="text-align:center;vertical-align:middle;" id="d20850e64">
              <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_passkeys.htm&amp;release=264.0.0&amp;type=5" title="Multi-factor authentication (MFA) verification is easy with a passkey (formerly known as built-in authenticator) service such as Windows Hello, Touch ID or Face ID, or a password manager. Users can quickly verify their identity with a fingerprint, iris, or facial recognition scan (or in some cases, with a PIN or password that the user sets up in their device's operating system). Passkeys provide secure, fast, easy login. They satisfy the phishing-resistant MFA requirement for privileged users.">Passkeys</a>
            </th>
            <th scope="col" class="slds-cell-wrap" style="text-align:center;vertical-align:middle;" id="d20850e74">
              <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_securitykey.htm&amp;release=264.0.0&amp;type=5" title="Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users.">Security Keys (Passkeys)</a>
            </th>
            <th scope="col" class="slds-cell-wrap" style="text-align:center;vertical-align:middle;" id="d20850e84">
              <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_sfa.htm&amp;release=264.0.0&amp;type=5" title="The Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use.">Salesforce
                Authenticator</a>
            </th>
            <th scope="col" class="slds-cell-wrap" style="text-align:center;vertical-align:middle;" id="d20850e94">
              <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_totp.htm&amp;release=264.0.0&amp;type=5" title="Salesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users.">Third-Party
                Authenticator Apps</a>
            </th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="PasskeysMulti-factor authentication (MFA) verification is easy with a passkey (formerly known as built-in authenticator) service such as Windows Hello, Touch ID or Face ID, or a password manager. Users can quickly verify their identity with a fingerprint, iris, or facial recognition scan (or in some cases, with a PIN or password that the user sets up in their device's operating system). Passkeys provide secure, fast, easy login. They satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e64 ">Operating system-level authentication that verifies identity with
              fingerprint, iris, or facial recognition scan, or a PIN or password.</td>

            <td data-label="Security Keys (Passkeys)Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e74 ">Physical devices that use public-key cryptography.</td>

            <td data-label="Salesforce AuthenticatorThe Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e84 ">A smart and simple mobile app that users can easily connect to
              their Salesforce accounts.</td>

            <td data-label="Third-Party Authenticator AppsSalesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e94 ">Apps that generate unique, temporary verification codes based on
              the OATH TOTP algorithm (specified in <a href="https://tools.ietf.org/html/rfc6238" target="_blank">RFC
                6238</a>).</td>

          </tr>
          <tr class="">
            <td data-label="PasskeysMulti-factor authentication (MFA) verification is easy with a passkey (formerly known as built-in authenticator) service such as Windows Hello, Touch ID or Face ID, or a password manager. Users can quickly verify their identity with a fingerprint, iris, or facial recognition scan (or in some cases, with a PIN or password that the user sets up in their device's operating system). Passkeys provide secure, fast, easy login. They satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e64 ">
              <p><em>Security Tier:</em></p>
              <p style="margin-bottom:0;"><a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_security_tiers.htm&amp;release=264.0.0&amp;type=5" title="The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. Some verification methods are stronger than others. Salesforce requires users with privileged permissions, such as admins, to use more secure methods.">Phishing-resistant</a></p>
            </td>

            <td data-label="Security Keys (Passkeys)Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e74 "><em>Security Tier:</em><a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_security_tiers.htm&amp;release=264.0.0&amp;type=5" title="The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. Some verification methods are stronger than others. Salesforce requires users with privileged permissions, such as admins, to use more secure methods.">Phishing-resistant</a></td>

            <td data-label="Salesforce AuthenticatorThe Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e84 "><em>Security Tier:</em><a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_security_tiers.htm&amp;release=264.0.0&amp;type=5" title="The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. Some verification methods are stronger than others. Salesforce requires users with privileged permissions, such as admins, to use more secure methods.">Standard</a></td>

            <td data-label="Third-Party Authenticator AppsSalesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e94 "><em>Security Tier:</em><a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_security_tiers.htm&amp;release=264.0.0&amp;type=5" title="The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. Some verification methods are stronger than others. Salesforce requires users with privileged permissions, such as admins, to use more secure methods.">Standard</a></td>

          </tr>
          <tr class="">
            <td data-label="PasskeysMulti-factor authentication (MFA) verification is easy with a passkey (formerly known as built-in authenticator) service such as Windows Hello, Touch ID or Face ID, or a password manager. Users can quickly verify their identity with a fingerprint, iris, or facial recognition scan (or in some cases, with a PIN or password that the user sets up in their device's operating system). Passkeys provide secure, fast, easy login. They satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e64 ">
              <p>
                <em>Form Factor:</em>
              </p>
              <p style="margin-bottom:0;">Available via a device's built-in authenticator service (for example, Windows
                Hello, Touch ID, and Face ID)</p>
            </td>

            <td data-label="Security Keys (Passkeys)Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e74 ">
              <p>
                <em>Form Factor:</em>
              </p>
              <p style="margin-bottom:0;">USB, Lightning, and NFC devices that support the WebAuthn and U2F standards</p>
            </td>

            <td data-label="Salesforce AuthenticatorThe Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e84 ">
              <p>
                <em>Form Factor:</em>
              </p>
              <p style="margin-bottom:0;">Mobile app for iOS and Android</p>
            </td>

            <td data-label="Third-Party Authenticator AppsSalesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e94 ">
              <p>
                <em>Form Factor:</em>
              </p>
              <p style="margin-bottom:0;">Mobile, desktop, and browser extension apps available for multiple operating
                systems</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="PasskeysMulti-factor authentication (MFA) verification is easy with a passkey (formerly known as built-in authenticator) service such as Windows Hello, Touch ID or Face ID, or a password manager. Users can quickly verify their identity with a fingerprint, iris, or facial recognition scan (or in some cases, with a PIN or password that the user sets up in their device's operating system). Passkeys provide secure, fast, easy login. They satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e64 ">
              <p>
                <em>User Experience:</em>
              </p>
              <ul>
                <li>Fast and easy to use.</li>

                <li>No apps required.</li>

                <li>A great choice if users need a non-mobile option.</li>

                <li>Strong public-key cryptography that's unique to the user's account.</li>

              </ul>
            </td>

            <td data-label="Security Keys (Passkeys)Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e74 ">
              <p>
                <em>User Experience:</em>
              </p>
              <ul>
                <li>Fast and easy to use.</li>

                <li>Recognizes and denies fraudulent requests.</li>

                <li>A great choice if users need a non-mobile option.</li>

                <li>Connectivity isn't required.</li>

                <li>No batteries needed.</li>

              </ul>
            </td>

            <td data-label="Salesforce AuthenticatorThe Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e84 ">
              <p>
                <em>User Experience:</em>
              </p>
              <ul>
                <li>Delivers push notifications to users' phones for fast access.</li>

                <li>See real-time details to confirm request validity.</li>

                <li>Deny fraudulent requests with a tap.</li>

                <li>Automates authentication from trusted locations</li>

                <li>Generates TOTP codes that work if connectivity isn't available.</li>

              </ul>
            </td>

            <td data-label="Third-Party Authenticator AppsSalesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e94 ">
              <p>
                <em>User Experience:</em>
              </p>
              <ul>
                <li>A wide variety of apps, including non-mobile options, to choose from.</li>

                <li>Codes work if connectivity isn't available.</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="PasskeysMulti-factor authentication (MFA) verification is easy with a passkey (formerly known as built-in authenticator) service such as Windows Hello, Touch ID or Face ID, or a password manager. Users can quickly verify their identity with a fingerprint, iris, or facial recognition scan (or in some cases, with a PIN or password that the user sets up in their device's operating system). Passkeys provide secure, fast, easy login. They satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e64 ">
              <p>
                <em>Considerations:</em>
              </p>
              <ul>
                <li>Device, operating system, and browser must support <a href="https://fidoalliance.org/fido2/fido2-web-authentication-webauthn/" target="_blank">FIDO2 WebAuthn standard</a>.</li>

                <li>Built-in authenticator service must be enabled and set up before MFA
                  registration.</li>

                <li>Works only for a single device.</li>

                <li>Supported scanner required for biometric identification.</li>

              </ul>
            </td>

            <td data-label="Security Keys (Passkeys)Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e74 ">
              <p>
                <em>Considerations:</em>
              </p>
              <ul>
                <li>Requires browser support (limited for U2F).</li>

                <li>Users could leave keys unattended or plugged in all the time.</li>

                <li>Operational overhead for purchasing, stocking, and distributing devices to
                  users.</li>

              </ul>
            </td>

            <td data-label="Salesforce AuthenticatorThe Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e84 ">
              <p>
                <em>Considerations:</em>
              </p>
              <ul>
                <li>Requires a mobile device.</li>

              </ul>
            </td>

            <td data-label="Third-Party Authenticator AppsSalesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e94 ">
              <p>
                <em>Considerations:</em>
              </p>
              <ul>
                <li>Typing errors are possible when manually entering codes.</li>

                <li>Invalid codes are possible if mobile device clock gets out of sync with
                  Salesforce.</li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="PasskeysMulti-factor authentication (MFA) verification is easy with a passkey (formerly known as built-in authenticator) service such as Windows Hello, Touch ID or Face ID, or a password manager. Users can quickly verify their identity with a fingerprint, iris, or facial recognition scan (or in some cases, with a PIN or password that the user sets up in their device's operating system). Passkeys provide secure, fast, easy login. They satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e64 "><em>Cost:</em> Starts around $25 for biometric peripherals, if
              needed</td>

            <td data-label="Security Keys (Passkeys)Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e74 "><em>Cost:</em> Starts around $20</td>

            <td data-label="Salesforce AuthenticatorThe Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e84 "><em>Cost:</em> Free</td>

            <td data-label="Third-Party Authenticator AppsSalesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users." class="slds-cell-wrap" style="vertical-align:top;" headers="d20850e94 "><em>Cost:</em> Free and paid options</td>

          </tr>
          <tr class="">
            <td data-label="PasskeysMulti-factor authentication (MFA) verification is easy with a passkey (formerly known as built-in authenticator) service such as Windows Hello, Touch ID or Face ID, or a password manager. Users can quickly verify their identity with a fingerprint, iris, or facial recognition scan (or in some cases, with a PIN or password that the user sets up in their device's operating system). Passkeys provide secure, fast, easy login. They satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d20850e64 ">
              <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_bia.htm&amp;release=264.0.0&amp;type=5" title="When employee users log in and register for multi-factor authentication (MFA), passkeys are the default option. Identify and resolve issues with passkey prompts, setup, login, and more.">Learn
                More</a>
            </td>

            <td data-label="Security Keys (Passkeys)Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users." class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d20850e74 ">
              <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_securitykey.htm&amp;release=264.0.0&amp;type=5" title="Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users.">Learn
                More</a>
            </td>

            <td data-label="Salesforce AuthenticatorThe Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use." class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d20850e84 ">
              <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_sfa.htm&amp;release=264.0.0&amp;type=5" title="The Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use.">Learn
                More</a>
            </td>

            <td data-label="Third-Party Authenticator AppsSalesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users." class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d20850e94 ">
              <a href="https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_totp.htm&amp;release=264.0.0&amp;type=5" title="Salesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users.">Learn
                More</a>
            </td>

          </tr>
        </tbody>
      </table>

Notes:

‣ If users don't want to use a mobile authenticator app, consider a TOTP desktop authenticator app or browser extension.

‣ Security keys that use the NFC form factor aren't supported in products built on the Salesforce Platform.

‣ WebAuthn-compatible security keys aren't supported in non-Chromium versions of the Edge browser.

‣ Built-in authenticators are supported in products built on the Salesforce Platform, Heroku, Marketing Cloud Intelligence, MuleSoft Anypoint Platform, and Tableau Cloud.

- **[Salesforce Authenticator for MFA](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_sfa.htm&release=264.0.0&type=5)**  
    The Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use.
- **[Passkeys for MFA](https://help.salesforce.com/s/articleView?id=xcloud.mfa_passkeys.htm&release=264.0.0&type=5)**  
    Multi-factor authentication (MFA) verification is easy with a passkey (formerly known as built-in authenticator) service such as Windows Hello, Touch ID or Face ID, or a password manager. Users can quickly verify their identity with a fingerprint, iris, or facial recognition scan (or in some cases, with a PIN or password that the user sets up in their device's operating system). Passkeys provide secure, fast, easy login. They satisfy the phishing-resistant MFA requirement for privileged users.
- **[Troubleshoot Passkey Issues](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_bia.htm&release=264.0.0&type=5)**  
    When employee users log in and register for multi-factor authentication (MFA), passkeys are the default option. Identify and resolve issues with passkey prompts, setup, login, and more.
- **[Security Keys (Passkeys) for MFA](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_securitykey.htm&release=264.0.0&type=5)**  
    Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users.
- **[Third-Party Authenticator Apps for MFA](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_totp.htm&release=264.0.0&type=5)**  
    Salesforce multi-factor authentication (MFA) supports the use of third-party authenticator apps that generate time-based one-time password (TOTP) codes. There are many mobile, desktop, and browser extension apps available, including free versions. Some popular options include Google Authenticator, Microsoft Authenticator, Authy, and password managers such as LastPass and 1Password. Third-party authenticator apps are considered standard-strength verification methods, so they can satisfy the MFA requirement for non-privileged users.