To prevent unauthorized access to Salesforce accounts, multi-factor authentication (MFA) is required when users log in. To help customers with this contractual requirement, Salesforce is making MFA a default part of the direct login process for production orgs. This change applies to production orgs created on or after April 8, 2024. It also applies to any existing production org that wasn’t included in one of the MFA auto-enablement phases that occurred between Spring ’23 and Spring ’24. Sandbox orgs aren’t affected. Orgs that are in a trial period aren’t affected until they’re converted to a subscription.
Where: This change applies to Lightning Experience, Salesforce Classic, and all Salesforce mobile apps in all editions.
When: This change goes into effect on April 8, 2024.
Why: On their own, usernames and passwords no longer provide sufficient protection against cyberattacks. MFA is one of the simplest, most effective ways to prevent unauthorized account access and safeguard your data and your customers’ data. Salesforce requires MFA to help protect against threats like phishing attacks, credential stuffing, and unauthorized account access. To learn more about the value of MFA and how it works, watch this short video.
How: When MFA is turned on for an org, users must verify their identity with a username and password, followed by a separate verification method. Verification method options include authenticator apps, security keys, and built-in authenticators. The first time each user logs in to their org, they’re guided through the steps to register a method.
There’s a 30-day grace period for the org during which users can log in without MFA if they’re not ready to set up a verification method. If needed, a Salesforce admin can temporarily turn off MFA by deselecting the Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org setting on the Identity Verification page in Setup. But keep in mind that MFA is contractually required, so re-enable it as soon as possible.
MFA Is Turned On by Default Starting April 2024 (salesforce.com)