How to Set Up Multi-Factor Authentication in Salesforce

In today’s landscape of growing cyber threats, safeguarding your Salesforce organization against unauthorized access and data breaches is paramount. While Salesforce’s two-factor authentication serves as a valuable security measure, it may no longer suffice. A potent solution to bolster security is by adopting Multi-Factor Authentication (MFA). By incorporating MFA into Salesforce, an additional protective barrier is erected, guaranteeing that only approved users can gain entry to confidential data and thwarting identity theft attempts. Let’s start How to Set Up Multi-Factor Authentication.

For comprehensive guidance on setting up MFA in Salesforce and activating it for both Salesforce and Experience Cloud, refer to the detailed insights provided in this blog post.

What does Multi-Factor Authentication entail, and how can you establish it within Salesforce?

Implementing multi-factor authentication (MFA) within Salesforce is an advanced security measure aimed at fortifying access protocols. This method enhances security by demanding users to present multiple forms of verification, usually two or more, when logging in.

Among these forms of verification is knowledge-based data such as usernames and passwords. Alongside these, possession-based factors like authenticator apps or security keys are utilized. Through the amalgamation of these diverse factors, Salesforce MFA strengthens security measures, effectively thwarting unauthorized access endeavors.

Different authentication methods for multi-factor authentication in Salesforce include.

Utilization of Built-In Authenticators: Integrated authenticators leverage biometric readers like fingerprint sensors, iris scanners, or facial recognition technology embedded within users’ devices to authenticate their identity. Common examples include Touch ID, Face ID, or Windows Hello.

Salesforce Authenticator Mobile Application: This dependable solution empowers users to enhance their login security by incorporating their mobile devices alongside passwords for verification. Through the Salesforce Authenticator app, users receive push notifications on their mobile devices, enabling them to conveniently validate logins with a simple tap response.

Configuring multi-factor authentication in Salesforce

Utilizing U2F or WebAuthn security keys, users can authenticate their identity when prompted. This eliminates the need for methods like Salesforce Authenticator or one-time passwords via email or SMS. Instead, users can simply insert their security key into their computer or mobile device’s designated port to complete the verification process.

Additionally, third-party time-based one-time passcode (TOTP) authenticator apps are available. These apps generate temporary verification codes using a random algorithm. Users receive these codes via phone or email and input them into a designated field during login.

Setting up Multi-Factor Authentication in Salesforce

A single configuration allows you to activate multi-factor authentication for all users in your organization. Once enabled, internal users must provide a secondary verification method alongside their username and password when logging in. This aligns with Salesforce’s initiative to automatically enable and enforce this security measure.

Below is a step-by-step guide to setting up MFA in Salesforce for all internal users in the organization as of 2024

1. Go to the Setup menu and type “Identity” in the Quick Find search bar. Then, select “Identity Verification.”

2. Check the box labeled “Require multi-factor authentication for all direct UI logins to your Salesforce organization.”

Activate Multi-Factor Authentication in Salesforce Experience Cloud

Enabling Multi-Factor Authentication (MFA) in Salesforce is optional for Experience Cloud sites, employee communities, help portals, and e-commerce platforms. You have the freedom to decide whether to activate MFA for external users accessing these sites, who can be distinguished by their license types:

Community licenses
External Identity licenses
Employee Community licenses (comprising either a Salesforce Platform license paired with a Company Community for Lightning Platform permission set license or a legacy Company Community license)

For external users accessing employee or other communities, MFA is unnecessary if they possess non-community licenses provided by Salesforce or a Salesforce partner.

However, it’s crucial to understand that MFA is mandatory for internal users, defined as individuals with standard user licenses, when logging into your company’s Employee Community or other Experience Cloud sites.

Setting up Multi-Factor Authentication in Salesforce Experience Cloud

Looking to establish a heightened security protocol in Salesforce for your online community? Utilize Multi-Factor Authentication (MFA) to add an extra layer of protection for users accessing your company’s Experience Cloud sites, employee communities, and other community portals.

Here’s a step-by-step guide for implementing MFA for community users:

Generate a permission set for multi-factor authentication. Navigate to Setup and enter “Permission” in the Quick Find box. Choose Permission Sets, then click New. Provide a label for the permission set and utilize the auto-generated API name. Save the changes.
Within System, access System Permissions. Edit the permissions and opt for Multi-Factor Authentication for User Interface Logins. Save the adjustments.
Assign the MFA Permission set to the relevant users.

Utilizing SMS for multi-factor authentication within Experience Cloud platforms as a security verification measure

Setting up Multi-Factor Authentication (MFA) in Salesforce entails certain restrictions regarding verification methods. Email, SMS, and phone calls are disallowed due to their susceptibility to compromise. However, for external users on Experience Cloud sites, SMS verification can be utilized, allowing authentication via text messages.

By enabling SMS one-time passcodes for MFA on your Experience Cloud site, users must opt for this method during initial registration. Subsequently, they can easily add other supported verification methods via the Advanced User Details or Personal Information page. Should users have multiple verification methods linked to their account, Salesforce automatically prioritizes the most secure option for multi-step login.

What steps are involved in utilizing SMS for verification within Salesforce?

To activate SMS multi-factor authentication in Salesforce, you’ll need an Identity Verification Credit Add-On license. Contact Salesforce Customer Support to activate this functionality. Also, ensure that the setting “Allow external users to verify their identity via text (SMS)” is enabled on profiles and permission sets.