If you run a Salesforce org, multi-factor authentication isn't optional anymore — and it hasn't been for a while. What's changed recently is how strictly Salesforce is enforcing it, which verification methods are still allowed, and how easily a small misconfiguration can lock half your team out on a Monday morning.
We've been helping clients get ahead of these changes, and a pattern has emerged: most orgs think they're compliant until enforcement tightens and something breaks. This post walks through what's actually changing, who's most at risk, and the practical checklist for getting your org in order.
Salesforce originally rolled MFA out as a contractual requirement back in 2022. Since then, the platform has progressively closed loopholes and removed weaker authentication methods. Three things in particular are worth paying attention to right now.
For years, users could satisfy MFA by receiving a one-time code via text message or email. That's no longer considered secure enough. Salesforce now expects users to verify through an authenticator app or a physical security key — and orgs still relying on SMS or email-based verification are exposed.
Third-party authenticators like Google Authenticator or Authy still work for time-based one-time passwords (TOTP), but Salesforce has been actively promoting its own mobile app. The Salesforce Authenticator app offers push approvals, location-based auto-approve, and a smoother login flow that's harder to fumble.
Orgs that had carve-outs for certain users, login flows that bypassed MFA under specific conditions, or service accounts that were never properly enrolled — those gaps are getting closed. If a user authenticates without MFA today, that's increasingly going to fail tomorrow.
Not every org is equally exposed. The ones most likely to experience a painful rollout are:
Most MFA problems don't come from Salesforce — they come from how the rollout was handled internally. The mistakes we see most often:
Whether you're doing this yourself or bringing in help, here's the checklist that covers the bases.
If you're a Salesforce admin, or you've got someone internal who can lead this, the checklist above is the playbook. It's not rocket science — just methodical work that has to be done right the first time.
If you don't have someone internal, or this isn't where you want your team spending their hours, that's where we come in. At AeyeCRM, we've been running MFA readiness reviews and rollouts for small businesses and family-operated companies — including consultancies that manage Salesforce across multiple client orgs. We'll audit what's in place, scope the migration, communicate the change to your team, and stay available during the cutover to handle any issues.
If your team is dealing with any of the issues above — or you'd just like a second opinion on whether your org is set up the right way — we'd be glad to talk. A quick call usually gets us to a clear scope and a fixed quote within a day or two.
Reach Philip at philip@aeyecrm.com or get in touch through our Contact Us Page.
We work primarily with small and family-operated businesses on Salesforce setup, customization, integration, and operational improvements — and we'd be happy to help.
About AeyeCRM. AeyeCRM is an Austin-based Salesforce consultancy specializing in setup, customization, automation, and integration for small businesses and family-operated companies. We help teams get more out of Salesforce without overcomplicating it.