--- schema_version: "1" id: 1712ebf54372753a3c135538c3a5ac91cea86a4200f0da6adf0099d9d2b0af3a title: Enabling and Managing Multi-Factor Authentication in Anypoint Platform collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/access-management/multi-factor-authentication.md canonical_url: https://docs.mulesoft.com/access-management/multi-factor-authentication source_site: docs.mulesoft.com content_type: documentation content_hash: 36b2b0824cbbad017e8f3000cca774bcec20ec8ef0c2c5540f2b6f9be120fb46 description: MuleSoft Documentation Site latest: true --- --- product: Access Management version: master --- # Enabling and Managing Multi-Factor Authentication in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Anypoint Platform multi-factor authentication (MFA) adds a second verification step when users log in with their Anypoint Platform credentials or via single sign-on (SSO). MuleSoft requires MFA for all users. You can also register authenticator apps, security keys, or built-in device authentication. Organization administrators configure exempt service accounts and reset MFA for individual users when needed. MFA is enabled by default for direct signins and can’t be turned off at the organization level. However, a few service account types don’t require MFA. An organization administrator can waive MFA for these accounts so that existing integrations can continue without interruption. > [!NOTE] For SSO users, set up MFA through the identity provider (IdP). Because MFA is managed by > the IdP, multi-factor authentication is shown as `n/a` in user Settings for SSO users. When a user signs in with their Anypoint Platform credentials, they must enter their password and then verify their identity with one of these verification methods: - Third-party TOTP authenticator apps - Built-in authenticator - Security key - Salesforce Authenticator ## Multi-Factor Authentication Requirements for Salesforce and MuleSoft Products - Effective February 1, 2022, MFA must be enabled for all of your Anypoint Platform users. To learn more about this contractual requirement, see the [Salesforce Multi-Factor Authentication FAQ](https://help.salesforce.com/s/articleView?id=000396727&type=1). - As of October 29, 2022, all non-SSO accounts that don’t have MFA configured are prompted to register for an MFA verification method and use it to log in to Anypoint Platform. ## Multi-Factor Authentication Verification Methods You can configure at least one of these verification methods to comply with multi-factor authentication requirements: Third-party TOTP authenticator app Registers an authenticator app to create verification codes that you provide when you log in to Anypoint Platform. Built-in authenticator Registers a physical authentication device, such as Touch ID or Windows Hello, to verify your identity when you log in to Anypoint Platform. Security key Registers a security key, such as Yubico YubiKey or Google Titan Security Key, to your account. Connect the security key to your computer to verify your identity when you log in to Anypoint Platform. Salesforce Authenticator Registers the Salesforce Authenticator mobile app to send you push notifications verifying your identity when you log in to Anypoint Platform. ## Exclude Exempt Accounts from Multi-Factor Authentication These types of service accounts are exempt from the requirement to use MFA: - Test automation tools, such as Selenium, Cucumber, or Appium - Robotic Process Automation (RPA) systems, such as Automation Anywhere > [!IMPORTANT] MuleSoft requires customers to use > [internal connected apps](https://docs.mulesoft.com/access-management/connected-apps-org-admin) instead of service accounts that make > programmatic calls to Anypoint Platform. Connected apps provide more security and control than > service accounts. If you’re having trouble switching to connected apps, reach out to MuleSoft for > help. In the meantime, you can temporarily waive MFA for your existing service accounts until > they’re transitioned to connected apps. To prevent service disruptions, waive MFA for valid MFA-exempt accounts in your organization. After August 1, 2023, waiving MFA for user accounts isn’t permitted. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the **Business Groups** menu, select your root organization. 4. In the Access Management navigation menu, click **Identity Providers**. 5. Select your Anypoint Platform identity provider. 6. In the **Exempt Accounts** section, add the accounts that are valid to exclude from MFA. Only accounts that don’t use single sign-on (SSO) appear in this list. 7. Click **Save**. The exempt accounts appear in the **Exempt Accounts** section. You can later remove user accounts from the **Exempt Accounts** list by clicking **X** next to their account names. ## Manage Multi-Factor Authentication for Your Account You can modify the verification methods that you use to log in. Register at least one method to use MFA. To modify verification methods in your account: 1. Sign in to Anypoint Platform. 2. In the Anypoint Platform navigation bar, click the circle icon with the initials associated with your Anypoint Platform account and select your name. 3. Select **Configure multi-factor authentication (MFA)**. 4. To register an additional verification method: 1. Next to the verification method to configure, click **Add**. 2. Follow the instructions to configure your preferred verification method. 3. Click **Done**. 5. To modify the name of an existing verification method: 1. Select the pencil icon next to the verification method to rename. 2. Enter a new name for your verification method. 3. Select the checkmark. 4. Click **Done**. 6. To remove a verification method: 1. Next to the verification method to remove, select the bin icon. 2. Click **Yes**. 3. Click **Done**. > [!NOTE] If you removed all verification methods, you must configure at least one > verification method before you save your changes. 7. Click **Save**. ## Reset Multi-Factor Authentication for Individual Users You can reset multi-factor authentication for individual users if a device is compromised or lost. If you’re the only organization member with Organization Administrator permission and have lost access to your verification methods, contact customer support. To reset multi-factor authentication for an individual user: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the **Business Groups** menu, select your root organization. 4. In the Access Management navigation menu, click **Users**. 5. Select the user to reset multi-factor authentication for. 6. From the actions menu (**…​**), select **Reset multi-factor authentication**. 7. Click **Confirm reset MFA**. Next time the user signs in to Anypoint Platform, they’re prompted to configure a new verification method. ## See Also - [Managing Security Settings](https://docs.mulesoft.com/access-management/managing-security-settings) - [Managing your Anypoint Platform Account](https://docs.mulesoft.com/access-management/managing-your-account)