In this video, we’ll show you how to prevent unauthorized account access by setting
up a multi-factor authentication -- or MFA -- login requirement for your Salesforce users.
When MFA is turned on, users must provide multiple pieces of evidence -- or factors
-- to prove their identity before they can log in.
The first factor is the user’s username and password.
For a second factor, users provide a verification method such as a mobile authenticator app
or a physical security key.
By requiring multiple types of factors for logins, even if a bad actor…
steals a user’s password, it’s unlikely that they can…
also guess or hack the user’s verification method.
Because launching MFA changes the login process, be sure to give users advance notice by communicating
the date and time that you’ll turn it on.
And let everyone know about the types of verification methods that are available, and how to use
them.
Enabling MFA is fast and easy.
First, create a permission set that requires users to provide a second factor of authentication
when they log in.
In Setup, enter Permission in the Quick Find box, and select Permission Sets.
Create a new permission set for MFA
then click Save.
Now use the Find Settings box to locate the “Multi-Factor Authentication for User Interface
Logins” permission.
Then click Edit at the top of the screen,
scroll back down to the MFA permission and select it,
and scroll back to the top to save your change.
The next step is to assign the permission set to your users.
Click Manage Assignments…
then Add Assignments.
Check the box next to the users who should log in with MFA, and click Assign, then Done.
In this example, we’re rolling out MFA in phases, starting with Karen Adams.
Karen is one of your Salesforce champions so she’s going to try out MFA and give you
feedback on the experience.
Now let’s see how the login process changes when MFA is enabled.
The first time Karen logs in after MFA is enabled, she’s prompted to register a verification
method.
She’ll use this method as her second authentication factor each time she logs in going forward.
Salesforce allows several types of verification methods for MFA
including
the Salesforce Authenticator app…
third-party Time-Based One-Time Password apps, like Google Authenticator, and
U2F-compatible security keys, such as Yubico’s YubiKey.
Salesforce Authenticator is a free mobile app for iOS and Android devices.
Karen is going to use this app as her verification method.
She starts by installing Salesforce Authenticator from the App Store or Google Play.
After she installs Salesforce Authenticator, she launches the app and takes the quick tour.
Now Karen is ready to connect Salesforce Authenticator to her Salesforce account.
On her mobile device, she taps Add an Account.
Salesforce Authenticator generates a unique two-word phrase.
Back in Salesforce, Karen enters the phrase and clicks Connect.
Then she’s prompted to confirm the connection in Salesforce Authenticator.
She reviews the details to make sure the connection request is legitimate .
Yes, it’s her connecting to Salesforce, so she taps Connect.
And that’s it!
Karen has successfully connected Salesforce Authenticator to her Salesforce account and
she finishes logging in.
Now let’s see how Karen uses the app as a second factor when she logs into Salesforce.
She enters her username and password, as usual.
Then Salesforce Authenticator sends a push notification to her mobile device.
Karen opens the app to see all the details of the login request.
She verifies that the request is coming from her, then taps Approve to finish logging in!
The way users register and log in with third-party authenticator apps and security keys is a
little different from what we just saw for Salesforce Authenticator.
But no worries, because users are guided through each process with in-app, step-by-step prompts.
To learn more about MFA, check out these resources.
Or, join us on the trail in the “MFA - Getting Started” community at trailblazer dot salesforce
dot com.