We created a Developer Edition org as our AppExchange Security Review test org. It has the reviewed package installed and configured, with:
- One System Administrator user.
- One Salesforce Standard User for testing the normal-user permission flow.
- Sample test records only.
We plan to provide both user credentials through the Security Review Wizard. However, logging in from a new browser triggers device activation and sends an OTP to the users’ registered email addresses, even though MFA is disabled.
How should we provide this org to Salesforce reviewers so they can log in independently without contacting us for the email OTP? Is there an approved setup for reviewer access to a Developer Edition org?
Hi Zinzalian,
Salesforce Security Reviewers don't have a special mechanism to bypass device activation or email OTP
for a Developer Edition org. If a login is considered to be from a new or unrecognized device, Salesforce may require identity verification even when MFA is disabled, as device activation is a separate security feature.
The usual approach for AppExchange Security Review is to:
- Provide the test org credentials (admin and standard user) through the Security Review Wizard.
- Ensure the user accounts have valid, accessible email addresses.
- If reviewers encounter a one-time device activation challenge, be prepared to assist by providing the verification code.
- Include any special login instructions or known prerequisites in the review notes so the reviewers know how to access the org.
There isn't a documented, reviewer-specific configuration that disables email OTP or grants Salesforce reviewers trusted access to a Developer Edition org. If you need a way for reviewers to log in without manual OTP assistance, it's best to open a case with the AppExchange Security Review team and ask whether they have an approved process for your submission.
