Restoring access after a lost MFA verification method
Key Takeaway
Restore MFA access with a temporary verification code to get the user in. Disconnect the old verification method so the user can register a new one, because a user can't register a replacement of the same type, such as a new Salesforce Authenticator app, until the old one is disconnected.
When multi-factor authentication (MFA) is required, a user who can't use their verification method can't log in. Verification methods include security keys, authenticator apps and passkeys. Admins restore access with two main tools: a temporary verification code that gets the user in right away, and disconnecting the old method so the user can register a new one or re-register the same one. The right steps depend on the problem. The user forgot their method, lost it or had it stolen, or has a method that stopped working or was replaced.
Temporary verification codes
A temporary verification code lets a user pass MFA without their usual verification method. When you generate the code, you set it to expire after 1 to 24 hours. Until it expires, the user can log in with the same code as many times as they need.
Temporary verification codes are valid for MFA only, so a user can't use one for device activation.
These rules apply when you generate a code:
- Each user can have only one temporary verification code at a time. If the user loses the code before it expires, manually expire the old code and then generate a new one.
- You can generate up to six codes per hour for each user.
- After you select "Done" when generating a code, you can't view that code again anywhere in the user interface. Give the code to the user before you close the window.
- You can't generate a temporary verification code for an inactive user.
- If your own session doesn't already have a high-assurance security level, Salesforce prompts you to verify your identity before it generates the code.