---
schema_version: "1"
id: 1e2991ab9e866145872d1e0e8002cd682adf95d7a9bf8781546424def80156bd
title: Understand MFA Requirements
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_understand_requirements.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_understand_requirements.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4aecf22b96f5e298855162d3f43900d59cbba145a55f3414e59ad081e4236b85
description: To protect users from security threats such as phishing, credential stuffing, and account takeovers, Salesforce requires multi-factor authentication (MFA) for all employee logins to Salesforce products. Understand MFA requirements based on the type of org, the type of user, and the user's level of access.
products:
  - Security
release: "264"
---
# Understand MFA Requirements

To protect users from security threats such as phishing, credential stuffing, and account takeovers, Salesforce requires multi-factor authentication (MFA) for all employee logins to Salesforce products. Understand MFA requirements based on the type of org, the type of user, and the user's level of access.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col style="width:100%"></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

MFA is required for internal users who log in to active production orgs and sandboxes to access the Salesforce user interface (UI). The requirement applies to both direct login and single sign-on (SSO). The MFA requirement is described in the Notices and Licenses Information section of the [Salesforce Trust and Compliance Documentation](https://www.salesforce.com/company/legal/trust-and-compliance-documentation/). Starting in June 2026, Salesforce enforces this requirement at login. After MFA is enforced, users can't log in without completing multi-factor authentication.

Also, internal users with certain privileged permissions, such as admins, are required to use phishing-resistant verification methods for MFA starting in June 2026. See [Phishing-Resistant MFA Requirement for Privileged Users](https://help.salesforce.com/s/articleView?id=xcloud.mfa_phishing_resistant.htm&release=264.0.0&type=5 "Salesforce requires multi-factor authentication (MFA) for all employee logins to Salesforce products. For internal user accounts that have a higher level of access, such as admin accounts, Salesforce requires extra security: users must complete MFA using a phishing-resistant method, such as a passkey or security key. This requirement applies to direct and single sign-on (SSO) logins for active production and sandbox orgs.") for detailed information about this requirement.

For both direct Salesforce logins and SSO, users can use the MFA services provided by the Salesforce Platform. For SSO logins, you can alternatively use an MFA service provided by the SSO provider. For example, if users log in with Okta, they can complete MFA with Okta's services before they're logged in to Salesforce. To use your SSO provider's MFA service, Salesforce requires the SSO provider to send specific authentication signals to Salesforce during SSO login.

MFA isn't required for API logins, but MFA is required for automation or integration users who access the Salesforce UI. You can satisfy the requirement by [programmatically completing MFA challenges](https://help.salesforce.com/s/articleView?id=xcloud.mfa_automation_totp.htm&language=en_US).

Let's break down the MFA requirement by org type, user type, and user's level of access.

## Determine the Org Type: Active or Non-Revenue?

Active orgs include production and sandbox orgs, while non-revenue orgs include scratch orgs, trial orgs, and more. Use this table to understand how Salesforce categorizes orgs as active or non-revenue.

  
| Active or Non-Revenue? | Org types | MFA Requirement |
| --- | --- | --- |
| Active | Production orgs and sandboxes, including Partial, Full, Developer, and Pro sandboxes | Required |
| Non-revenue | Scratch orgs, trial orgs, Developer Edition orgs, Partner Developer Edition orgs, and Trailhead playgrounds | Not required |

## Determine the User Type: Internal or External?

An internal user is anyone who has a standard user license and who can access your Salesforce org's UI. Internal users include admins, developers, privileged users, standard users, and users authorized to act on your company's behalf, such as partners and third-party agencies.

External users can only access your company's Experience Cloud sites, ecommerce sites or storefronts, help portals, employee communities, and so forth.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d98675e164">Internal or external?</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d98675e167">User License Types</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d98675e170">MFA Requirement</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Internal or external?" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e164 ">Internal</td>

            <td data-label="User License Types" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e167 ">
              <ul>
                <li>
                  <a href="https://help.salesforce.com/s/articleView?id=platform.users_license_types_available.htm&amp;language=en_US" target="_blank">Standard Salesforce licenses</a>
                </li>

                <li><a href="https://help.salesforce.com/s/articleView?id=platform.users_license_types_chatter.htm&amp;language=en_US" target="_blank">Chatter Only (Chatter Plus)</a></li>

              </ul>
            </td>

            <td data-label="MFA Requirement" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e170 ">Required</td>

          </tr>
          <tr class="">
            <td data-label="Internal or external?" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e164 ">External</td>

            <td data-label="User License Types" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e167 ">
              <ul>
                <li>
                  <a href="https://help.salesforce.com/s/articleView?id=platform.users_license_types_communities.htm&amp;language=en_US" target="_blank">Experience Cloud licenses</a>
                </li>

                <li><a href="https://help.salesforce.com/s/articleView?id=platform.users_license_types_chatter.htm&amp;language=en_US" target="_blank">Chatter External</a></li>

                <li><a href="https://help.salesforce.com/s/articleView?id=platform.users_license_types_chatter.htm&amp;language=en_US" target="_blank">Chatter Free</a></li>

              </ul>
            </td>

            <td data-label="MFA Requirement" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e170 ">Not required</td>

          </tr>
        </tbody>
      </table>

## Determine the Internal User's Level of Access: Privileged or Non-Privileged?

All internal users are required to use MFA, but users with a higher level of access to Salesforce must use more secure verification methods. Learn how Salesforce defines privileged access and how to satisfy MFA requirements.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d98675e260">privileged or non-Privileged?</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d98675e263">Criteria</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d98675e266">MFA Requirements</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="privileged or non-Privileged?" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e260 ">Privileged</td>

            <td data-label="Criteria" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e263 ">
              <p>A user is considered privileged if they meet any of these criteria:</p>
              <ul>
                <li>System Administrator profile OR</li>

                <li>Author Apex user permission OR</li>

                <li>Customize Application user permission OR</li>

                <li>Modify All Data user permission OR</li>

                <li>View All Data user permission</li>

              </ul>
              <p style="margin-bottom:0;">Most Salesforce admins and developers are considered privileged.</p>
            </td>

            <td data-label="MFA Requirements" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e266 ">These users must use a phishing-resistant verification method to satisfy the
              MFA requirement.</td>

          </tr>
          <tr class="">
            <td data-label="privileged or non-Privileged?" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e260 ">Non-privileged</td>

            <td data-label="Criteria" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e263 ">A non-privileged user is simply any user who doesn't meet the criteria for
              privileged access. Most employee users are considered non-privileged.</td>

            <td data-label="MFA Requirements" class="slds-cell-wrap" style="vertical-align:top;" headers="d98675e266 ">These users can satisfy the MFA requirement with either phishing-resistant or
              standard verification methods.</td>

          </tr>
        </tbody>
      </table>

## Enforcement Timeline

Salesforce enforces MFA requirements in the summer of 2026. For detailed rollout timelines, see these articles.

- [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&type=1&language=en_US).
- [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US).