Configure Phishing-Resistant MFA for Salesforce System Administrator

Configure Phishing-Resistant MFA for Salesforce System Administrators 
(Windows Hello or Mac Touch ID)

Overview

Salesforce is introducing new security requirements for System Administrator users.

To comply with these requirements, System Administrators should register a phishing-resistant authentication method such as:

• Windows Hello 
• Mac Touch ID 
• Passkeys 
• Security Keys (FIDO2/WebAuthn) 

This guide walks through the steps to enable the required Salesforce settings and register Windows Hello or Touch ID.

Step 1: Enable Identity Verification Settings

1. Navigate to Setup. 
2. Search for Identity Verification in Quick Find. 
3. Open Identity Verification Settings. 
4. Enable the following options: 
   • Let users verify their identity with a built-in authenticator such as Touch ID or Windows Hello 
   • Show all verification method registration options instead of starting with built-in authenticators 
   • Allow passwordless login with passkeys 
5. Click Save. 

 
 
Identity Verification Settings with the required options enabled.

Step 2: Configure Windows Hello or Touch ID on the Device

Before registering a built-in authenticator in Salesforce, make sure Windows Hello or Touch ID is configured on the device.

Windows

1. Open Windows Settings. 
2. Navigate to Accounts > Sign-in Options. 
3. Configure one or more of the following: 
   • PIN 
   • Fingerprint Recognition 
   • Facial Recognition 

Mac

1. Open System Settings. 
2. Select Touch ID & Password. 
3. Configure Touch ID using your fingerprint. 

Step 3: Register Windows Hello or Touch ID in Salesforce

1. Log in to Salesforce. 
2. Click your profile picture and select Settings. 
3. Open Advanced User Details. 
4. Under Built-In Authenticators, click Add. 
5. Complete the identity verification process if prompted. 
6. Enter a name for the authenticator. 
7. Follow the prompts to register Windows Hello or Touch ID.  
    

 
 
Registering a built-in authenticator from Advanced User Details.

Step 4: Verify the Login Experience

After registration is complete:

1. Log out of Salesforce. 
2. Log back in. 
3. Verify that Windows Hello or Touch ID is available during login.  
    
   

Note: Once registered, Windows Hello or Touch ID may become the preferred authentication method for future logins.

Managing Authenticators

Users can manage their authenticators at any time.

1. Open Settings. 
2. Navigate to Advanced User Details. 
3. Rename or remove authenticators as needed. 

Administrators can also manage authenticators from the user record.

Reviewing Authentication History

Administrators can review authentication activity and adoption.

1. Navigate to Setup. 
2. Search for Identity Verification History. 
3. Review login activity and authentication methods used by users. 

Frequently Asked Questions

Who should complete this setup?

Any user who does not possess any one of these privileges: System Administrator profile, Modify All Data, View All Data, Customize Application, or Author Apex. Note: Users with these privileges are subject to stricter Phishing-Resistant MFA requirements.

How long does setup take?

Most users can complete the setup in less than 10 minutes.

Can I register more than one authentication method?

Yes. Salesforce supports multiple authentication methods, and registering a backup method is recommended.

Can I remove or replace an authenticator later?

Yes. Authenticators can be managed from Advanced User Details at any time.