Salesforce Multi-Factor Authentication (MFA) Changes Coming in 2026

Salesforce is continuing its efforts to strengthen platform security by expanding Multi-Factor Authentication (MFA) requirements across additional user experiences and authentication scenarios.

Enrollment Rx customers should evaluate how users currently authenticate into Salesforce, Experience Cloud sites, and related applications. This includes reviewing existing MFA policies, identifying users who have not enrolled in MFA, validating recovery procedures, and ensuring that supported authentication methods are available to all users. Institutions should also communicate upcoming changes to administrators, staff, and other stakeholders who may be affected.

As part of your preparation, we recommend:

• Reviewing your current Salesforce MFA settings and policies.
• Identifying users who are not enrolled in MFA.
• Verifying that backup and recovery procedures are documented and tested.
• Confirming that Experience Cloud and administrative users can successfully complete MFA challenges.
• Communicating upcoming requirements and timelines to affected users.
• Using the Salesforce MFA Requirement Check to verify your implementation.

Taking these steps now can help reduce disruption, improve security posture, and ensure a smoother transition as Salesforce introduces additional MFA requirements.

For detailed information regarding Salesforce's upcoming MFA initiatives, please review the official Salesforce resources and guidance. This article on the Salesforce Ben website offers additional guidance. To review all recent or upcoming Salesforce Security Related Product Updates, please visit this page: Security-Related Product Updates to the Salesforce Platform: User Identity, Data Protection, and Access Controls.

Enrollment Rx will continue monitoring these changes and will provide additional recommendations as new information becomes available.