Access Management Best Practices

Question 1

How can Multi-Factor Authentication (MFA) be triggered in Salesforce using Apex or Login Flows?

Answer 1

In Salesforce, MFA can be programmatically triggered using Apex by leveraging the System.UserManagement class methods to initiate and complete verification services for methods like Salesforce Authenticator and SMS. Alternatively, MFA can be enforced during user login by configuring Login Flows that prompt users to complete MFA steps, such as entering a time-based one-time password (TOTP), before granting access.

Question 2

How can Multi-Factor Authentication (MFA) be enabled in Salesforce?

Answer 2

MFA can be enabled in two ways:
1.Assign the Multi-Factor Authentication for User Interface Logins user permission through a permission set for specific users.

2.Enable MFA for all users in the org by selecting the Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org checkbox on the Identity Verification page in Setup.