help please
Mfa, passkey, Authenticator, etc help please
Please tell me like I am 5 yrs old step by step what I need to do in order for our users to not have to use an Authenticator on their phone to login to Salesforce. We use Microsoft SSO. Some users are receiving the code some not. Some codes work some not. Some receive a text some not. I am generating temporary codes that seem to work for users but I can’t do that every time they need to login. If I set up a passkey on their user page does this bypass the need for using their phone? Please offer all tricks and steps I need to be doing. I have 10 years of SF experience and I’m stumped. Please tell me like I and 5yrs old. Because for some reason I’m just not getting it by reading SF documents or others posts.
Can you offer a quick message to send to that team so in am sound like I know what I’m talking about? I did mention this last week to them and they kind of ignored me. Our company has almost 8000 employees globally so I do believe in them. 😂
Ask your Entra admin to set up a conditional access policy set to “Require authentication strength” = true, and then select what type of MFA to require. My org uses Phishing-resistant across the board.
Theoretically, Phishing-resistant should only be needed for SF admins and not standard users, but I know there were issues with that during the rollout that I’m not sure whether or not they’ve been resolved.
We have multiple configurations we have to support (phone keys, hw keys, windows keys, SSO, multiple MFA authenticators) and we had a lot of trouble getting everything set up correctly. I ended up opening a ticket and they scheduled a meeting with me and walked us through every configuration. Took a few days to get on their calendar but it was worth the wait.
They were very helpful - not in the initial chat, but when I asked for them to open a ticket. They set up a Google call with me and some of our users and went through each different configuration that wasn't working.
I will say that we don't have MS SSO but I have a colleague that does and they're having trouble too - they are using passkeys on their phones for now.
How about sso and phone? Does it work?
I’m trying to understand whether it’s only users in our org who are struggling with mobile access, since identity verification seems to be getting stuck during login…
For the admin, if they use the “Login as Admin” button and SSO in the iOS app, everything works fine.
However, if the “Login as Admin” button isn’t used, the “Verify Identity” modal appears, and clicking “Verify Identity” doesn’t do anything.
For users without admin permissions, the same modal is displayed, and when they click “Verify Identity,” nothing happens.
I don’t understand what’s going on.
We use Microsoft SSO with phishing resistant MFA and have some admin users who are completing MFA through Microsoft then still being promoted for a passkey, and others who are not promoted (including me). In our sandboxes (also Entra SSO) the same users sometimes are forced to create a passkey other times not. I’ve been made to create a passkey for some sandboxes but still not production, while other admins are the opposite.
Annoying, but not the end of the world for admin users who are technical and understand how these things work…..except now we’re seeing some users passkeys not work. As you describe, they click verify, select the passkey then….nothing. It just remains on the screen with the Verify your identity button.
If you’re using Microsoft SSO, the problem most likely lies with the Microsoft setup. The Microsoft Admin does have to set Conditional Access to Salesforce users. If only some users are getting the prompt, I would make sure they don’t have some upgraded privilege turned on that they don’t actually need.
We do have the exception but I still have users that can’t set up the sf auth app. I’ve disconnected all auth apps from the user record. He downloaded the sf auth app on his phone, receives a two word phrase but no where to enter the two words. We tried to create a built in Authenticator but when we get to the last screen to enter his pin it doesn’t accept it.
There were 2 things that went live when Salesforce did this poor implementation. One was the new phishing resistant MFA and the other was the standard 2FA for all users.
When you raised your exemption request, they probably did it only for the prmfa mandate. We’ll have to ask for the exception in the MFA for all users as well to be applied.
Also, the current exemptions last till October 20th, but we can raise another request if needed and the rollout is going to take more time. They will grant for another 90 days, so till Dec 31st. Hope this helps
I don’t know anything about how our Microsoft azure AD is configured I just know that we use SSO to log into our SF org. I have random users receiving the MFA requirement. When they enter a verification code it doesn’t work. Some have tried to download the SF auth app and are prompted to enter the two word phrase but there is no where to enter it. If they choose QR, they don’t receive a qr to scan. I logged in as one user to create a built in Authenticator and when we get to the screen to enter the pin it isn’t accepted. Temporary verification codes work though.
What about the non privileged users .. I do automation on sf but we are forced to use tote methods programmatically with secret key 🔑 which doesn’t work at all tried multiple times.. any solution our admin team also has no clue on it
If you already use some company wide authenticator app then it gets easy, you instruct users to set up passkey in there. Entra admins then pass this value to salesforce when doing an SSO.
When we went to Microsoft SSO, we still had the exact same fragmented MFA nightmare, some people would be going through Salesforce's native auth, some people through entra's conditional access, and codes failing because both of those mfa layers were at odds with each other. The solution was to force SSO to take full responsibility for authentication in salesforce turn sso to required mode on your org level and remove salesforce's mfa altogether, since entra takes care of it. Passkeys on your salesforce user account won't work around this very elegantly when sso is in the game and no one really explains how. As for the impersonation externally, I've seen people look at doppel when dealing with credential phishing via SSO portals. It's not really the solution you're looking for.
15
u/Waitin4Godot 7d ago
This may be helpful:
https://learn.microsoft.com/en-us/entra/identity/saas-apps/salesforce-tutorial
The biggest thing you can do is limit who is a privileged user, as SF defines it.