Multi-factor authentication -- or MFA -- is one of the most effective ways you can prevent
unauthorized account access, and safeguard your Marketing Cloud tenant against threats
like phishing attacks, credential stuffing, and account takeovers.
When MFA is turned on, users must provide multiple pieces of evidence -- or factors
-- to prove their identity before they can log in.
The first factor is the user’s username and password.
For a second factor, users provide a supported verification method, such as a mobile authenticator
app or a physical security key. By requiring multiple types of factors for
logins, even if a bad actor steals a user’s password, it’s unlikely
that they can also guess or hack the user’s verification method.
Before enabling MFA, let’s go over a few considerations.
You enable MFA at the top-level account. You can’t enable or disable MFA at the individual
Business Unit level, or exclude specific users from MFA.
Finally, you need to add some IP addresses to your mail exchange allow list to permit
MFA verification communications. The full list of addresses is provided in Salesforce
Help.
When you’re ready to launch MFA, give everyone advance notice by communicating the date and
time that you’ll turn it on.
And let everyone know about the types of verification methods that are available, and how to use
them.
Enabling MFA is fast and easy.
For a shortcut, use the in-app message that displays when you log in.
Simply click Enable to get started. You automatically switch to the Multi-Factor
Authentication page in Setup.
Edit the page then select Enable Multi-Factor Authentication and save your changes.
After MFA is turned on, things change a little bit for each user -- yourself included.
First, the login process invites users to start receiving MFA challenges. This message
repeats for every login until the user accepts the invitation.
Let’s opt into MFA now.
As a security measure, you need to verify your identity before continuing.
Enter the verification code that you receive in email and click Verify.
Then you’re prompted to register a verification method that you’ll use to prove your identity
each time you log in going forward. Marketing Cloud allows several types of verification
methods for MFA, including the Salesforce Authenticator app WebAuthn and U2F-compatible
security keys, such as Yubico’s YubiKey, and third-party One-Time Password apps, like
Google Authenticator. Salesforce Authenticator is a free mobile
app for iOS and Android devices. Let’s register this app as our verification method.
Start by installing Salesforce Authenticator from the App Store or Google Play.
Then open the app and take the quick tour. Now you’re ready to connect Salesforce Authenticator
to your Marketing Cloud account. On your mobile device, tap Add an Account.
Salesforce Authenticator generates a unique two-word phrase.
Enter that phrase on your computer, then click Connect.
Marketing Cloud prompts you to confirm the connection in Salesforce Authenticator.
The app shows details about the account you’re connecting to. Double-check everything is
correct then tap Connect.
And that’s it! You’ve successfully connected Salesforce Authenticator with your Marketing
Cloud account.
Now when you log in, you can use Salesforce Authenticator as the second factor for proving
your identity. Let’s see what that experience looks like.
Enter your username and password, as usual.
Then Salesforce Authenticator sends a notification to your mobile device.
Open the authenticator app to see all the details of the login request.
Verify that the request is coming from you then tap Approve to finish logging in.
The way users register and log in with security keys and third-party authenticator apps is
a little different from what we just saw for Salesforce Authenticator.
But no worries, because users are guided through each process with in-app, step-by-step prompts.
To learn more about MFA for Marketing Cloud, check out these resources.
Or, join us on the trail in the “MFA - Getting Started” community at trailblazer.salesforce.com.