Enable MFA for Select Users

Follow Along with Trail Together

Want to follow along with an expert as you work through this step? Take a look at this video, part of the Trail Together series.

(This clip starts at the 6:13 minute mark, in case you want to rewind and watch the beginning of the step again.)

Introduction

In this step, you learn how to enable MFA for select users by assigning them a user permission. Start by creating a user in your org. Let’s call her Sia Thripio. Then, create a permission set for multi-factor authentication and assign the permission set to Sia.

Create a User

1. From Setup, enter Users in the Quick Find box, then select Users.
2. Click New User.
3. In the first name field, enter Sia.
4. In the last name field, enter Thripio.
5. Enter your email address in the Email field. This setting is to get user notifications for Sia.
6. Create a username for Sia and enter it in the Username field. It must be in email address format, but it doesn’t have to be a working email address. Make sure the email address is unique in your Trailhead Playground. Need ideas? Try using Sia’s first initial, last name, and the current date, like this: SThripio.12202020@trailhead.com.
7. Edit or accept the nickname value.
8. For User License, select Salesforce Platform.
9. For Profile, select Standard Platform User.
10. Deselect the options to receive Salesforce CRM content alerts. No need to clutter your inbox with unnecessary email from Salesforce.
11. Scroll down to the bottom of the page and select Generate new password and notify user immediately.
12. Click Save. Salesforce emails you a link to verify the user and set Sia’s password because you entered your email address in the Email field. Note: If you get an error that the username exists, create a user with a different name.
13. Log in as Sia, and reset the password.

Create a Permission Set for Multi-Factor Authentication

Enable MFA for specific users by assigning them the Multi-Factor Authentication for User Interface Logins user permission. You can do this step by creating a permission set that you assign to users.

A permission set is a collection of settings and permissions that gives users access to various Salesforce features. Let’s create a permission set with the MFA permission.

1. If you’re logged in as Sia, log out.
2. Log in again as the system administrator of your Trailhead Playground.
3. From Setup, enter Permission in the Quick Find box, then select Permission Sets.
4. Click New.
5. Label the permission set MFA Authorization for User Logins.
6. Use the autogenerated API name: MFA_Authorization_for_User_Logins.
7. Click Save.
8. Under System, click System Permissions.
9. Click Edit.
10. Select Multi-Factor Authentication for User Interface Logins.
11. Click Save, then click Save again to confirm permission changes.

 You’re almost there! You just need to assign the permission set to Sia’s user.

Assign the Permission Set

For now, let’s assign the permission set just to Sia. Later, when you’re ready to roll out MFA more broadly, you can assign the same permission set to other users.

If you’re not on the detail page for your new permission set, navigate back there.

1. On the detail page of the new permission set, click Manage Assignments.
2. Click Add Assignments.
3. On the list of users, select the checkbox next to Sia’s user. (You can assign up to 1,000 users at a time.)
4. Click Next.
5. Click Assign.
6. Click Done.

Great! You’ve turned on multi-factor authentication for Sia. The next time Sia logs in, she’s prompted to provide a verification method as a second factor, in addition to her username and password.

Resources

• Salesforce Help: Enable MFA for Specific Users
• Salesforce Help: Permission Sets