Salesforce multifactor authentication - FAQ

From 1 February 2022, Salesforce is going to make multifactor authentication mandatory to access the application. In this article, we answer the most frequently asked questions so that you are well prepared for this important change.

Why does Salesforce choose multifactor authentication?

As the number of digital threats increases, so does the focus on security. And that is a good thing!

A first step in security is preventing unauthorised access to IT systems. Using only a username and password is actually no longer possible anno 2021. Passwords are too often shared, 'leaked' or easily guessed by powerful computers. That is why Salesforce is going to make multifactor authentication mandatory from 1 February 2022. That means you have to identify yourself in at least two ways before you are logged in. For example, think of entering a password as well as a code from an authentication app on your mobile phone.

What does multifactor authentication mean?

This means proving in more than one way that you are really the one trying to log in. A password is the first 'factor' (something you knows), a numerical code via your mobile phone is a second 'factor' (something you has). This is also known as two-step verification.

As a Salesforce customer, am I required to use multifactor authentication?

Salesforce is going to enforce this from 1 February 2022. So yes. It would be wise to activate and communicate this to users before 1 February 2022. Activation can be done incrementally if desired, for example by profile.

Are there any alternatives?

You could use Single Sign On. That means that with a valid login to Microsoft or Google, you can also immediately access Salesforce without being asked for an additional login. Single Sign On can be set up fairly quickly by a Salesforce administrator in consultation with the administrator of the Microsoft or Google environment. Make sure that logging in to this environment is also really secure by setting up multi-factor authentication there too, otherwise the backdoor will still be open!

Does multifactor authentication apply to all Salesforce accounts?

No, this only applies to users who want to work in the Salesforce application via a browser. Accounts used for an integration (e.g. with website or financial system) are excluded. It also excludes users of a community (Experience Cloud).

What ways for authentication are there?

Salesforce offers three options for the additional authentication:

• The Salesforce Authenticator App
• Another Authenticator app (from Google or Microsoft)
• A physical USB security key (e.g. the Titan Security Key)

Sending codes via text or email is not considered secure enough by Salesforce.

What does g-company recommend as the best method for authentication?

g-company recommends using the Google or Microsoft Authenticator app. The reason is that authentication is then possible from multiple devices. This is especially useful when a login account such as 'office manager' is used by more than one person. With the Salesforce Authenticator app, an account can only be linked to one device for authentication.

How do I enable authentication via multiple devices?

Once multifactor authentication is active, the first login attempt will ask for an authentication method. Then choose either the Google or Microsoft Authenticator app. Take a screenshot of the QR code that appears, paste it into a document and share the file only with the person who is also allowed to log in with the account in question. Once that person wants to log in, he/she can scan this QR code via an Authenticator app.

What if my users don't have a smartphone?

In that case, you would have to provide a smartphone or USB security key.

What if users forgot their phone or security key?

In that case, they should contact the application administrator, who can provide a temporary access code.

What if the administrator cannot be reached?

g-company recommends appointing at least two administrators. Besides an internal administrator, this could be g-company's support department, which is always available during office hours. If one administrator cannot get into Salesforce, the other can still step in. In extreme cases, Salesforce support can be contacted to gain access.

What if a phone is lost?

In that case, the administrator can reset the authentication method so that you can log into Salesforce via a different device.

How am I going to start with this?

Salesforce has published extensive documentation, such as this compact manual and this video. The application manager can pick this up himself, or contact g-company for advice and implementation.