Salesforce Phishing-Resistant MFA: What You Need to Know

Salesforce is mandating Phishing-Resistant MFA for all administrator and high-privilege users to counter sophisticated cyber threats. Traditional verification methods like SMS and basic authenticator apps will no longer be accepted for these users.
The update rolls out to

• Sandboxes on June 22, 2026
• Production on July 1, 2026

Internal IT and implementation teams will manage the transition on the backend, ensuring zero disruption to regular business operations.

• Targeted Enforcement: The mandate only applies to administrators and users with broad data access permissions
  • Modify All Data
  • View All Data
  • Customize Application
  • Author Apex. General users are exempt.
• Upgraded Security Standards: Traditional 6-digit codes and SMS are out. Physical security keys (YubiKeys) and device biometrics (Touch ID, Windows Hello) are in.
• Imminent Deadlines: Enforcement hits sandboxes on June 22, 2026, and production environments on July 1, 2026.

________________________________________________________________________________________________________________________________________________________________

For years, standard MFA methods – such as SMS text codes, email verification, and basic 6-digit authenticator apps – served as a reliable second line of defense. However, modern cybercriminals now use advanced, real-time phishing and “adversary-in-the-middle” (AitM) attacks to intercept these traditional tokens.

As a result, Salesforce is shifting toward Phishing-Resistant MFA to eliminate these vulnerabilities entirely. Furthermore, this advanced standard relies on hardware-based encryption or device-bound biometrics, ensuring malicious actors cannot intercept, spoof, or reuse login credentials.

This mandatory update specifically targets the keys to your digital kingdom. In particular, the requirement applies strictly to:

• System Administrators
• High-Privilege Users: Anyone holding broad system permissions, such as View All Data or Modify All Data.

On the other hand, this strict requirement does not impact regular business users and external, customer-facing communities (Experience Cloud users). Therefore, they can continue using their current standard login methods without any disruption to their daily workflows.

Salesforce will automatically enforce these strict security policies according to a progressive timeline.

• First, the update begins in Testing Environments (Sandboxes) on June 22, 2026. Subsequently
• Production Environments enforcement hits on July 1, 2026.

Once enforcement takes effect, Salesforce will block affected administrator accounts from logging in using standard text codes or basic mobile push notifications. Instead, they must authenticate using secure hardware or built-in device authenticators, such as:

• Biometrics: Windows Hello, Apple Touch ID, or Face ID

• Hardware: Physical USB security keys (e.g., YubiKeys)

Managing this transition smoothly requires analyzing how your team currently accesses the platform. Typically, organizations fall into one of two implementation paths:

1. Integrating SSO with Salesforce Phishing-Resistant MFA (SSO)

For instance, if your team logs into Salesforce through an identity provider like Microsoft Entra ID, Okta, or Google Workspace, the focus shifts to your SSO configuration. In this case, your internal IT or implementation department must review these settings. Consequently, they can guarantee that your provider seamlessly communicates the required security claims to Salesforce during the login sequence. The claims are: MFA signals such as AMR/ACR

2. Direct Salesforce Logins

If your administrative staff logs directly into the Salesforce platform, the configuration happens natively.

• The Goal: Safe enablement of WebAuthn protocols within your Salesforce org.

• The Action: Administrators must be guided through a secure enrollment process to register their corporate devices, biometrics, or physical keys prior to the enforcement dates.

If you currently work with a dedicated Salesforce implementation team, they are already taking proactive responsibility for planning, configuring, and testing this transition.

In the coming weeks, expect technical teams to run authentication tests in your sandbox environments to catch any edge cases. Additionally, you should reach out to your internal IT stakeholders or implementation partner to review your environment’s specific setup, ensuring full hardware compatibility before the July deadline.

Contact Us today for further assistance and support