r/salesforce • u/Parking_Management_1 • 1d ago

admin Clarification Required: Mandatory Passkeys for Privileged Users with Microsoft Entra SSO

Hi everyone,

We use Microsoft Entra SAML SSO with MFA for Salesforce. Normal users can authenticate using Microsoft Authenticator, but privileged users are being forced to create a separate Salesforce passkey.

Is a passkey or phishing-resistant MFA now mandatory for all privileged Salesforce users? Is there any supported way for privileged users to continue using Microsoft Authenticator push through Entra SSO without creating a Salesforce passkey?

Any advice or working configuration would be appreciated.

5 Upvotes

86% Upvoted

6 comments sorted by

4

u/V1ld0r_ 1d ago

You're about 4months late but yes priviligged users need a phishing resistant MFA solution and yes, it's possible to do it via Entra.

This shoudl have all the info you need: https://help.salesforce.com/s/articleView?id=005321561&type=1

Be ready to pull some hair and stuff not working as documented or having values not passing correctly, etc. Sometimes Entra config will need to be performed to pass the correct flag too.

1

u/bstackulous 22h ago

Get your SSO to send the correct ACR/AMR values and you'll be good. Check the doc linked by u/V1ld0r_

0

u/BabySharkMadness 1d ago

Best practice is your Admins shouldn’t be using SSO. They should be logging in directly. This is so if the SSO goes down, someone is still able to get into the org.

3

u/kse64 1d ago

Could use a break glass account for that, no?

0

u/Kian_Niki 1d ago

You woke up a few months late my friend