With MFA becoming mandatory starting June 2026 for both sandbox and production environments, I have a question regarding our current setup.
At present, users log in to Salesforce via SSO using Microsoft accounts (Azure/Entra ID), and MFA is already enforced at the identity provider level. Similarly, access to Azure DevOps (ADO) is also managed through Entra ID, where MFA is enforced.
Given this setup, is it still necessary to enable Salesforce-native MFA for users, or is enforcing MFA through the identity provider (Entra ID) sufficient to meet the requirement?
Appreciate any guidance or clarification on this.
MFA with your SSO will work for your non-privileged users. Note that MFA is currently required in all production orgs, but not in sandboxes. Between June 22 and 29, MFA will be required in all sandboxes, too.
However, sysadmins and users with one or more of these permissions (view all data, modify all data, customize application, author apex) will need to add phishing-resistant MFA to their login pattern.
Because Salesforce hasn't created a way for us to test this specific division between phishing-resistant and non-phishing resistant requirement, I don't know exactly what the login experience will be in prod with SSO. My educated guess is that it will be one of these two sequences after launching Salesforce from our MyDomain link:
- Use the SSO MFA as before, and then use the phishing-resistant MFA; or
- Use only the phishing-resistant MFA.
