Phishing Resistant MFA

For those who are looking clarity about Phishing Resistant MFA which as stated by Salesforce will take effect on:

• Sandboxes: Starting June 22, 2026, staggered over approximately 7 days
• Production: Starting July 1, 2026, staggered over approximately 30 days

Sharing some clarity. Hope it will be useful for you guys!

They must comply with Phishing Resistant MFA, meaning when loging in with SSO in SAML response any of this values should be present: cert, fido, fido2, fpt, hwk, iris, pin, pki, pop, retina, sc, Smartcard, swk, TLSClient, user, vbm, wia, X509. 

Privileged Users (with Modify All Data, View All Data, Customize Application, Author Apex permissions) with UI logins: 

They must comply with Phishing Resistant MFA meaning when loging in with SSO in SAML response any of this values should be present: cert, fido, fido2, fpt, hwk, iris, pin, pki, pop, retina, sc, Smartcard, swk, TLSClient, user, vbm, wia, X509. 

Integration Users 

All Integration Users must use API Only User to bypass this requirement (User, not the connected app) if someone is actually loging in. If they don't have it, they must comply with Phishing Resistant MFA meaning when loging in with SSO in SAML response any of this values should be present: cert, fido, fido2, fpt, hwk, iris, pin, pki, pop, retina, sc, Smartcard, swk, TLSClient, user, vbm, wia, X509. If no logins are performed (you can check such integration users login history), then no impact should be visible on them.  

To check what values in the SAML Response you are receiving with user logins, you can try and use some SAML response analyzer tool, for example I'm using SAML Tracer (chrome extension) 

https://chromewebstore.google.com/detail/saml-tracer/mpdajninpobndbfcldcmbpnnbhibjmch?hl=en

Hope this clears things out for you! 

Source:

https://help.salesforce.com/s/articleView?id=005321563&type=1

and discussions with Salesforce Support 🫡