Hi everyone,
I’m experiencing a persistent WebAuthn loop during MFA setup in one specific Salesforce organization, and I’d really appreciate the community’s technical insight into what could be causing the discrepancy.
I have two independent Salesforce environments running on the same Windows 11 laptop and using the same browsers (Chrome/Edge).
Org A
Everything works as expected:
- When I go to Advanced User Details → Built-In Authenticators → Add, Windows Security displays the native “Sign in with a passkey” prompt.
- It correctly recognizes the credential for my Salesforce user.
- The credential is associated with the expected Salesforce domain
- I can authenticate immediately using my local Windows Hello PIN.
Org B
The behavior is completely different:
- Under Advanced User Details → Built-In Authenticators → Add, Windows Security does not offer the local “This Device” / Windows Hello platform authenticator.
- Instead, it immediately launches the roaming/cross-platform authenticator flow and displays the Mobile Phone / QR-code prompt.
- Selecting “Choose a different passkey” or “Save another way” does not expose Windows Hello; it simply returns me to the same QR-code flow.
- As a result, I am effectively stuck in an unskippable WebAuthn registration loop.
Settings already verified in Org B
I have checked the relevant Salesforce configuration and cannot identify an obvious organizational restriction:
- Identity Verification Settings “Let users verify their identity with a built-in authenticator (passkey) such as Touch ID or Windows Hello” is explicitly enabled.
- Session Security Level Policies Administrative operations, including Profile and Permission Set management, are configured with None for High Assurance session step-up requirements.
- Browser extensions The Microsoft Authenticator extension is enabled in both environments, so extension differences do not appear to explain the behavior.
I would appreciate any suggestion as I am running in loops and have always to use my iphone to scan a QR Code because Salesforce is asking me for a passkey. I can not use my PIN in Windows Hello.
@Salesforce Administrators & Developers, @Salesforce Administrators and Developers, @APAC Architects
#Trailhead #Salesforce Developer #Salesforce Admin #TrailblazerCommunity
Hi Lena, since both orgs are on the same laptop/browser and your Salesforce config in Org B genuinely looks correct, this is very likely a browser/Windows-side caching issue tied to the different origin (domain), not a Salesforce policy difference. A few things worth checking:
1. Check Windows' own Passkey manager for a stale entry. Go to Windows Settings → Accounts → Passkeys (or Sign-in options → Passkeys). Look for any existing entry tied to Org B's domain — even a partial/failed registration attempt from earlier can cause Windows to skip the "create new" platform flow and jump straight to the cross-device/roaming flow instead. Delete any entry there for Org B's domain, then retry from Salesforce.
2. Clear the browser's per-site permissions for Org B's domain. Chrome/Edge cache a "last used transport" preference per relying-party origin. In Chrome: Settings → Privacy and security → Site settings → search for Org B's domain → Clear data/reset permissions. This forces the browser to re-evaluate available authenticators instead of defaulting to whatever you (or a prior session) picked before.
3. Confirm Org B's My Domain is fully deployed, not just the default login URL. WebAuthn ties credentials to the Relying Party ID (essentially your domain). If Org B is still on a default/undeployed domain or recently changed its My Domain, the RP ID Salesforce sends can differ from what you'd expect, which changes how the browser matches existing/available authenticators.
4. Try a fully fresh browser profile/incognito window against Org B only, to rule out any extension (you mentioned Microsoft Authenticator extension is on in both — try disabling it just for this test) or cached state interfering specifically with that origin.
5. As a last resort, use "Disconnect a passkey that isn't working" from your Salesforce personal settings (Advanced User Details → Built-In Authenticators → Del on any existing/broken entry for Org B), then try Add again from a clean state.
If none of that breaks the loop, this is worth escalating to Salesforce Support directly with both orgs' IDs — a same-device, same-browser, config-identical discrepancy between two orgs isn't something Setup-level settings can explain, and Support can check server-side registration options (like exclude-credential lists) that aren't visible from the UI.
Reference:
https://help.salesforce.com/s/articleView?id=005390721&language=en_US&type=1
