Starting in June 2026, Salesforce will begin enforcing stricter authentication requirements across all organisations, including both sandbox and production environments.<\/p>\n
This is not an optional security<\/a> enhancement. Organisations that have not yet fully adopted Multi-Factor Authentication (MFA) will need to prepare before the enforcement dates arrive.<\/p>\n For most businesses, the good news is that compliance may be simpler than expected. Many users already have the necessary technology built into their laptops and mobile devices.<\/p>\n<\/div> Salesforce is enforcing two existing authentication requirements for most customers.<\/p>\n First, Multi-Factor Authentication (MFA) will become mandatory for all employee users accessing Salesforce<\/strong><\/span>, whether they log in directly or through Single Sign-On (SSO).<\/p>\n Second, users with elevated privileges – including System Administrators and users with permissions such as Modify All Data, View All Data, Customize Application, or Author Apex – must use phishing-resistant MFA. Traditional authenticator apps that generate six-digit codes will no longer be sufficient as the primary authentication method for these users.<\/p>\n<\/div>\n For organisations that have not yet reviewed their authentication strategy, these dates are closer than they may appear.<\/p>\n<\/div> The most common attack against business applications today is no longer password guessing. Instead, attackers rely on phishing techniques that trick users into revealing credentials or approving login requests in real time.<\/p>\n Even standard MFA methods can be vulnerable to these attacks. A user may unknowingly provide a valid one-time code to a fraudulent website, allowing an attacker to gain access before the code expires.<\/p>\n Phishing-resistant authentication addresses this problem by cryptographically binding authentication to the legitimate Salesforce domain. Even if a user is tricked into visiting a fake login page, the authentication process cannot be completed.<\/p>\n For users with administrative access, Salesforce now considers this level of protection essential.<\/p>\n<\/div>\nWhy is Salesforce making this change?<\/h2><\/div>
\n\n
\n User Type<\/strong><\/th>\n Requirement<\/strong><\/th>\n Recommended Method<\/strong><\/th>\n<\/tr>\n<\/thead>\n\n \n Standard Users<\/td>\n MFA Required<\/td>\n Salesforce Authenticator or Passkey<\/td>\n<\/tr>\n \n Administrators<\/td>\n Phishing-Resistant MFA Required<\/td>\n Windows Hello, Touch ID, Face ID, Passkey<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n \n
Why Salesforce is raising the bar<\/h2><\/div>