Identity verification methods and challenges
Key Takeaway
Privileged internal users must use a phishing-resistant method, such as a passkey, to meet the MFA requirement. Other internal users can use a standard method. Internal users can't use email or SMS codes to log in with MFA.
Identity verification is how a Salesforce user proves they are the real owner of an account. The user gives extra evidence, called a verification method, such as a fingerprint scan, a physical security key, or a code from an authenticator app. Admins choose which methods users can use.
The three forms of identity verification
Identity verification has three forms. Each form asks for a verification method at a different moment:
- Multi-factor authentication (MFA) asks for a verification method at login, in addition to the username and password.
- Device activation asks for a verification method when a user logs in from an unrecognized device.
- Step-up authentication asks for a verification method before a sensitive action, which is an action that needs a higher session security level. For example, a user with a standard session might open a resource that requires a high-assurance session.
Device activation no longer applies when MFA is enabled, because users must verify their identity at every login, whether or not their device is recognized.