Salesforce to require MFA from February next year

Salesforce will require all customers to enable multi-factor authentication to log into its services from February 1 next year.

The vendor sent a note to customers on Wednesday morning advising them of the change in security policy.

“As your partner in protecting your customer data, we’re announcing that, beginning February 1, 2022, Salesforce will begin requiring customers to enable MFA [multi-factor authentication]  in order to access Salesforce products,” the company said.

“By tying user access to multiple types of factors, MFA makes it much harder for common threats like phishing attacks and account takeovers to succeed.”

Salesforce said it encouraged Salesforce administrators to start planning for the change.

“You must enable MFA for users who log in to your Salesforce products (including partner solutions) through the user interface,” it said.

“Alternatively, you can satisfy the MFA requirement by using single sign-on (SSO) for your Salesforce products - but we also strongly recommend enabling MFA for your SSO solution’s identity provider.”

Salesforce provided a list of products that already support MFA.

These included:

• Products built on the Salesforce Platform, including: Sales Cloud, Service Cloud, Analytics Cloud, B2B Commerce Cloud, Experience Cloud, Industries products (Consumer Goods Cloud, Financial Services Cloud, Government Cloud, Health Cloud, Manufacturing Cloud, Philanthropy Cloud), Marketing Cloud–Audience Studio, Marketing Cloud–Pardot, Platform, Salesforce Essentials, Salesforce Field Service, and partner solutions
• B2C Commerce Cloud
• Marketing Cloud–Datorama
• Marketing Cloud–Email Studio, Mobile Studio, and Journey Builder
• MuleSoft Anypoint Platform
• Quip

The company said it is “hard at work developing MFA for all our other Salesforce products, and [is] committed to delivering this functionality well before the MFA requirement takes effect so you have time to implement successfully.”

“You will hear from us as this support becomes available in the coming months,” it said.

Salesforce has published a note on the change in policy here.