Understanding and Enabling Multi-Factor Authentication (MFA)

Follow

Practifi is built on the Salesforce platform, and as your technology partner, we work diligently to ensure any Salesforce enhancements and changes are well understood in advance. Salesforce has announced their intention to make enabling multi-factor authentication (MFA) mandatory. Many Practifi clients have already enabled this feature as part of their security protocols. If you are unsure if you have this feature enabled, this article will outline future impacts on your users and security configurations. 

About MFA

MFA adds another layer of security to your login process by requiring users to enter two or more pieces of evidence — or factors — to prove they are who they say they are. The first factor is the username and password. The second factor is an authenticator app, which can be installed on a user’s mobile device.

Upcoming Changes

Salesforce will begin MFA enforcement in their May/June 2023 release. System administrators in Practifi can disable MFA in Settings until this point, as it is only auto-enablement in MFA occurring in January and not MFA enforcement. 

After MFA is auto-enabled in your organization, users are prompted to provide a verification method in addition to their username and password each time they log into Practifi. Verification methods include authentication apps, security keys and built-in authenticators like Windows Hello or Touch ID. If a user hasn't already registered a method, they will be guided through the simple process at their next log-in.

There is a 30-day grace period where users can skip registration and login to Practifi without using MFA. The grace period begins on the day MFA is auto-enabled in your organization and the same 30-day window applies to all users of Practifi organization. 

When MFA enforcement occurs in Salesfore's next release, system administrators will not be able to turn off the Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org setting. Users will receive an MFA challenge each time they log in directly with their username and password and will be required to complete this challenge. Users who weren't already using MFA will be prompted to register for it when they log in and will not be able to access their Practifi account until they do so. 

MFA Recommendations

There are many options for Multi-Factor Authentication. You may already have a firm-wide approach including Authenticator Apps provided by Salesforce or third parties, physical keys or authenticators built into your device's operating system, such as Touch ID. 

At this time, we highly recommend the Salesforce Authenticator App.  The Salesforce Authenticator App is available for Android and iOS devices and offers the following benefits:

  • End users can click “approve” on the push notification instead of typing in the rotating code. (This feature can help reduce support requests.)
  • We believe this app is most likely to stay aligned and compatible with future authentication changes to the Salesforce platform.

Enabling MFA in Your Practifi Organization

To enable MFA in your organization, Practifi Administrators can simply add the MFA Permission Set (Practifi - Login - Enforce two-factor authentication) to each user. Please review Adding and Removing User Permissions for assistance managing permission sets.

This Salesforce article will guide you through the steps to enable multi-factor authentication (MFA) using the security level, either standard or high assurance, assigned to a login method in your Salesforce session settings.

If you need more help, contact us via the Practifi Success Portal and our team will guide you through the implementation process.

Handling Lost or Replaced Devices

If a user loses the device they use for MFA, or simply gets a new device, it is suggested to disconnect the previous verification method and then re-register them. Please see this Salesforce documentation on disconnecting and registering verification methods.

0 out of 0 found this helpful

Comments

0 comments

Article is closed for comments.