If you're responsible for administering Salesforce, there's an important platform change you should review right now. Salesforce is introducing phishing-resistant multi-factor authentication (MFA) requirements for users with elevated privileges. Many organisations already use MFA, but that does not automatically mean they satisfy the new requirement. If affected users haven't enrolled in a compliant authentication method by the enforcement date, Salesforce may prevent them from logging in until they do.

The most common misconception

One comment we've heard repeatedly is: "We already use MFA, so we're covered." Unfortunately, it's not always that simple.

Phishing-resistant MFA is designed to provide stronger protection against credential theft and phishing attacks. Depending on your current setup, traditional MFA methods may not satisfy the new requirements for privileged Salesforce users. The important point is not to assume compliance simply because MFA has already been rolled out across your organisation.

Who should review their setup?

This change is particularly relevant for users with elevated permissions. That includes all people with System Administrator rights, but it may also include users who have been granted powerful permissions through profiles or permission sets, such as:

• Modify All Data
• View All Data
• Customize Application
• Author Apex
• Other administrative capabilities

Every Salesforce organisation is different, so it's worth reviewing who has privileged access rather than focusing solely on job titles.

Many organisations have more privileged users than they realise

During implementations and business projects, administrator rights are often granted temporarily to developers, consultants or power users. Sometimes those permissions are never removed.

We've also seen organisations where multiple teams have been assigned broad administrative rights simply because it made day-to-day support easier. As a result, the group affected by Salesforce's phishing-resistant MFA requirement may be larger than expected. Now is an excellent opportunity to review who genuinely needs elevated permissions.

What should you do before enforcement?

Act this minute. Don't wait. The enforcement deadline is literally around the corner: Salesforce will start enforcing phishing resistant MFA with sandboxes on June 22, 2026, staggered over approximately 7 days. Enforcement in Salesforce production environments will be next, starting July 1, 2026, staggered over approximately 30 days.

A few simple checks can help avoid unnecessary disruption.

• Review privileged users: Identify everyone with administrative profiles or highly privileged permission sets.
• Confirm authentication methods: Verify that affected users have registered an authentication method that satisfies Salesforce's phishing-resistant requirements.
• Test both production and sandboxes: Don't wait until an urgent deployment or production incident to discover that someone cannot log in. Verify access in advance.
• Review integrations and deployment processes: If your organisation uses deployment tools or metadata-based administration, perform a quick validation after making authentication changes.
• Ensure backup administrator access: Confirm that more than one trusted person can administer your Salesforce environment if required.

This is about more than compliance

Although this change is driven by security, it also highlights a broader point. Salesforce is a continuously evolving platform. Every year brings new functionality, feature retirements, release updates and operational changes that can affect how your organisation works.

Authentication requirements are just one example. Other platform updates may influence integrations, automation, user permissions, APIs or product capabilities. Keeping on top of these developments helps reduce unexpected disruption and ensures your Salesforce environment continues to operate smoothly.

An opportunity to review administrator access

We recommend seeing this as an opportunity rather than a nuisance. Many organisations benefit from periodically reviewing administrator permissions. Questions worth asking include:

• Does every System Administrator require full administrative access?
• Are there legacy permissions that could be removed?
• Could permission sets provide more targeted access?
• Have temporary project permissions become permanent without review?

Applying the principle of least privilege not only strengthens governance but can also simplify future platform changes.

Organisations using Google Workspace

All companies have options on how to configure these new security requirements. If your organisation already uses Google Workspace, integrating passkeys or phishing-resistant authentication methods may provide a straightforward route to compliance. Other organisations may prefer native Salesforce passkeys or different identity solutions depending on their environment and security strategy. The right approach will vary, but the key is to validate your configuration before enforcement takes effect. Companies using Microsoft Office 365 and Teams need to configure this slightly differently.

The benefits of having a Salesforce partner who looks after you

One of the biggest benefits of working with an experienced Salesforce partner like CloudAnalysts is staying ahead of changes like these. Rather than reacting when users encounter login issues or unexpected platform behaviour, proactive monitoring allows organisations to assess new requirements, review potential impacts and make any necessary adjustments in advance. We help you maintain business continuity as you are upgrading your systems.

Whether it's authentication changes, seasonal releases, product updates or new platform capabilities, keeping Salesforce healthy, configured to your users satisfaction and as a competitive advantage: that's is an ongoing process rather than a one-off project.

Final thoughts

Salesforce's phishing-resistant MFA requirement is a sensible evolution in platform security, but it's worth taking a few minutes to verify whether your organisation is ready. Don't assume that existing MFA automatically means compliance. Review privileged users, confirm authentication methods and test access before enforcement reaches your organisation.

And if you're looking for a Salesforce partner who keeps an eye on platform changes and helps clients stay ahead of them as part of ongoing support, CloudAnalysts' managed services are designed to do exactly that. See our Salesforce Services Overview, CRM Strategy Consulting and Salesforce Managed Services to learn more.

Need help before the deadline?

We've already worked through the practical implementation and common pitfalls of Salesforce's new phishing-resistant MFA requirements for ourselves and several of our clients. If you'd like us to review your organisation or configure the changes for you, get in touch. In many cases, we can complete the work during a short remote support session without requiring a full-day engagement. Give us a call: +44 (0) 330 808 3317, or book a meeting.