#MFA16 discutindo

I'm running into two issues and hoping someone can point me in the right direction.

This occurs even though I'm already logged in as an admin and my device has a built-in authenticator available.

Troubleshooting already attempted:

• Confirmed MFA is configured under Session Security Levels.
• Temporarily adjusted MFA-related session security settings and retested.
• Cleared browser cache/cookies.
• Tested in both Chrome and Edge.
• Verified active administrator session and attempted identity re-verification.
• Same error persists.

Issue 2: Unable to Log a Salesforce Support Case I then attempted to log a Salesforce Support Case via Salesforce Help, but I don't have a "New Case"

option available anywhere in the support portal.  

Has anyone encountered either of these issues before?

• Is there a prerequisite for generating temporary MFA verification codes that I might be missing?
• Are there specific permissions or support entitlements required before the "New Case" option appears in Salesforce Help?

Any advice would be greatly appreciated. Thanks! 

*** Important updates: MFA Enforcement Update: R1 Window Rescheduled to July 27-28 ***We wanted to give you a heads-up that the R1 MFA enforcement window has been updated. Here's what you need to know:

What Changed

The R1 enforcement window has moved from July 21–22 to July 27–28.

Why the Change

We made this adjustment to address a few things:

• Additional time was needed to fully process previously approved extensions
• Some SSO users on orgs with approved extensions were being unexpectedly prompted for MFA

If You Have an Approved Extension

Keep in mind that approved extensions can take up to 48 hours to take effect, so you may still see MFA prompts during that window.

If your org has an approved extension but you're still being prompted for a passkey, please refer to this Knowledge Article for detailed guidance on specific use cases.

What's Not Changing

• The MFA for All schedule remains the same
• R2a, R2b, Japan & Korea, and all subsequent release groups are on their original schedules

Where to Find the Latest Info

The PRMFA Knowledge Article has been updated to reflect the new R1 window — that's your best source for the current schedule and details.

Have questions? Drop them in the comments below and we'll do our best to help! 

While the intent behind Salesforce’s step-up authentication framework is both understandable and necessary given the increasing sophistication of data exfiltration risks, the current implementation introduces meaningful friction into core user workflows—particularly around reports and dashboards, which are among the most frequently accessed features for our business teams. 

From an adoption and usability standpoint, this experience is suboptimal. Requiring users to re-authenticate at the point of simply

a report—potentially multiple times per day—creates interruption in critical workflows, slows down data access, and adds cognitive and operational overhead. This is especially impactful in environments like ours where we are actively driving Salesforce adoption, encouraging teams to replace offline trackers, and reinforcing Salesforce as the single source of truth. 

There is a real risk that this added friction could inadvertently push users back toward less secure, manual alternatives (e.g., screenshots, exported files stored locally, or shadow tracking), which ultimately undermines both the adoption goals and the spirit of the security control itself. 

While the security objective is valid, the user experience could be significantly improved with more thoughtful enablement patterns and modern authentication approaches. Guidance that I would have assumed be offered by Salesforce themselves. 

For example:

• Seamless, low-friction verification methods such as push-based approvals (e.g., Salesforce Authenticator prompts) should be the default and strongly encouraged over email/SMS OTP, which are slower and more disruptive.
• Biometric-based authentication (Face ID, Touch ID) and passkey/passwordless experiences should be positioned as the primary path to reduce user effort during step-up challenges.
• Clear guidance and best practices from Salesforce on how to configure session policies (e.g., optimal step-up intervals by role/use case) would help organizations strike the right balance between security and usability.
• Proactive end-user enablement (tooltips, in-product guidance, and admin playbooks) would ensure users understand why the prompt is happening and how to complete it quickly.

Ultimately, achieving the right balance between security and usability

is critical. If step-up authentication becomes too intrusive, it risks becoming a barrier to productivity and platform adoption—particularly for high-frequency report users. 

A more user-centric approach—leveraging modern, fast, and intuitive authentication methods combined with stronger guidance for Salesforce—would help ensure this change enhances security

. 

Any suggestions?  

The MFA Scamble

A step-by-step guide to setting up phishing resistant MFA for Salesforce admins.

https://www.freelikeapuppy.tech/post/the-mfa-scramble