--- schema_version: "1" id: f4080e3745925dddef0f06a544cfbd3277f1e39f5db7b5fa30901b145970ab16 title: Salesforce Authenticator for MFA collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_supported_verification_methods_sfa.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_sfa.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 56ecf349fc54d419ded0e5638efb22dab779b1eaa4f8cae158e01ab9c0c14e1e description: The Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use. products: - Security release: "264" --- # Salesforce Authenticator for MFA The Salesforce Authenticator mobile app is a verification method that can be used as a second factor for multi-factor authentication (MFA) logins. The app is free and simple to use. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png) Important MFA requirements are changing in June 2026. - Salesforce enforces MFA for direct UI and SSO logins for all employee users across production and sandbox orgs. See [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&type=1&language=en_US). - Salesforce requires phishing-resistant MFA for users with the System Administrator profile or certain permissions. See [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US). Salesforce Authenticator is available for all Salesforce products that provide MFA functionality. Salesforce Authenticator makes MFA authentication easy because the app automatically integrates into the Salesforce login process with push notifications. After a user enters their username and password, the app sends a notification to the user's mobile device. The user taps the notification to open Salesforce Authenticator, verifies that the login request is coming from them, and then they’re logged in. In addition to push notifications, Salesforce Authenticator generates time-based one-time passcode (TOTP) codes that allow users to authenticate even if their mobile device doesn’t have a data connection. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png) Note We highly recommend that users set up a PIN or biometric requirement on their mobile device to ensure that unauthorized parties aren’t able to access Salesforce Authenticator. Download the Salesforce Authenticator app from the Apple App Store or Google Play. Then, [register Salesforce Authenticator as an identity verification method for Salesforce orgs](https://help.salesforce.com/s/articleView?id=xcloud.salesforce_authenticator_add_account.htm&language=en_US). ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png) Important As a security best practice, require users to use phishing-resistant verification methods: [Troubleshoot Passkey Issues](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_bia.htm&release=264.0.0&type=5 "When employee users log in and register for multi-factor authentication (MFA), passkeys are the default option. Identify and resolve issues with passkey prompts, setup, login, and more.") or [Security Keys (Passkeys) for MFA](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_securitykey.htm&release=264.0.0&type=5 "Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users."). For more information about the security benefits of these methods, see the [WebAuthn guide](https://webauthn.guide/). #### See Also - [_Video_: How to Use Salesforce Authenticator for MFA Logins](http://salesforce.vidyard.com/watch/JyZ_mibupf6sOzMwvhtA3g) - [Register Salesforce Authenticator as an Identity Verification Method](https://help.salesforce.com/s/articleView?id=xcloud.salesforce_authenticator_add_account.htm&type=5&language=en_US) - [Salesforce Authenticator](https://help.salesforce.com/s/articleView?id=xcloud.salesforce_authenticator_overview.htm&type=5&language=en_US) - [MFA Verification Methods for Direct Salesforce Login](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods.htm&release=264.0.0&type=5 "The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce MFA functionality supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. You can control which methods are available to your users.")