Multi-factor authentication requirements
Key Takeaway
Salesforce requires multi-factor authentication (MFA) for internal users but not for external users or API logins. To require MFA for external users, assign the "Multi-Factor Authentication for User Interface Logins" permission. To require it for API logins, assign the "Multi-Factor Authentication for API Logins" permission.
Multi-factor authentication (MFA) makes a user prove their identity with a second piece of evidence in addition to their password. Salesforce requires MFA for internal users to protect against phishing, credential stuffing, and account takeovers. As an admin, you need to know who must use MFA and which verification methods count. You also need to know how Salesforce treats direct, single sign-on (SSO), API, and automation logins differently.
Two kinds of factors
MFA combines two kinds of factors. The first factor is something the user knows: their username and password. The second factor is something the user has, such as an authenticator app or a security key. A stolen password alone isn't enough to get into the org, because the attacker also needs the second factor.