If you’re still confused about what’s happening with Salesforce’s MFA rollout, you’re not the only one. Original timelines for this were rewritten, production enforcement began in late July, and since then, the guidance for MFA enforcement and phishing-resistant enforcement has been difficult for some customers to follow.
After alleged communications from Salesforce Support indicated that enforcement dates could once again be pushed back and even delayed indefinitely, it became clear that customers were not all on the same page. Here are the latest updates you need to know.
Salesforce’s MFA Rollout
Although Salesforce has been on MFA compliance since 2022, earlier this year, the company announced that it would be making MFA mandatory for all users, effective June 2026. Users were warned that if they were not enrolled in MFA by the deadline, they may need to complete verification steps every now and then to stay in Salesforce or may not be able to log in.
In early July, the enforcement was briefly paused as Salesforce worked to resolve an issue in which users with existing security keys were incorrectly prompted to register new ones during the phishing-resistant MFA enrollment process. From there, a new enforcement rollout timeline was established, with production enforcement commencing on July 20.
Salesforce began enforcing that requirement at login and requiring phishing-resistant MFA (PR-MFA) for admins and other users with elevated permissions.
However, last week, some customers allegedly began receiving notifications that indicated Salesforce was delaying enforcement beyond late October and that there was currently no new enforcement date. There were also alleged talks of a tool being released by mid-October that would allow customers to apply for a 90-day extension.
The Latest Updates
Salesforce has confirmed that the enforcement date has not been delayed indefinitely, and that the company is currently working directly with a small number of customers who previously received an extension but need additional time to make the required changes. Salesforce claims that over 90% of its customers have adopted MFA.
A Salesforce spokesperson told SF Ben that customers should stay focused on the communications coming out, and that any customer who has yet to adopt MFA or PRMFA will be contacted by Salesforce directly.
“There are no indefinite delays on anything,” they said. “All controls will be implemented. Over the next six to eight months, depending on exactly what the situation is, we’ll be working with individual customers to finish the project with them.”
Final Thoughts
As more communication around this matter continues to arise, we will keep you as updated as we can.
Have any questions for us or Salesforce? Bring them to us, anonymously or not, at tips@salesforceben.com.
