Multi-factor authentication for all

Note Salesforce updates are subject to change beyond our control. Sage People attempts to maintain our content in alignment: for the most up to date information, refer to Salesforce documentation.

What's happening?

Salesforce is enforcing Multi-Factor Authentication (MFA) for all employee logins. This includes direct UI and Single Sign-On (SSO), across both production and sandbox orgs.

Note The waive MFA permission will no longer work from enforcement.

When is this happening?

  • Sandboxes: Starting June 22, 2026, staggered over approximately seven days

  • Production: Starting July 20, 2026, staggered over approximately 30 days

Will this affect you?

  • Any users that log in directly to Sage People (not via SSO) and don't use MFA will need to set up MFA

  • If your identity provider (SSO provider) doesn't pass a standard MFA or phishing-resistant MFA signal (AMR/ACR), users can't log in until they enable it

Recommended action

If you use Single Sign-on, we recommend you check with whoever administers your single sign-on connection for these changes. They’ll have access to the necessary tools.

If you have any users that login to Sage People directly, ensure they have MFA set up.

Check with your Identity Provider that they pass an MFA signal to Sage People.

For more information, see the Salesforce article Prepare for MFA enforcement for all employee users.

Ways to MFA

  • Third-party authenticator apps for MFA (Includes phone and web browser options)
    To log in using this type of verification method, the user gets a code from their authenticator app. They then enter that code during the Salesforce log in process

  • Built-in authenticator service (Pin, Windows Hello, Touch ID, Face ID etc.)
    This type of method provides the easiest MFA login experience, After a user enters their Salesforce username and password, the built-in authenticator prompts them. This can be a biometric check, a PIN, or password identifier

  • Security keys for MFA (USB keys)
    Security keys make MFA logins fast and simple. After the user enters their username and password, they're prompted to connect the security key to their computer. This can be via a port or wirelessly. They then press the button on the key to confirm their identity

    For more information and to compare MFA options, see the Salesforce article Verification methods for MFA.How to check if SSO is passing MFA signals

How to check if SSO is passing MFA Signals

  1. In Salesforce Setup, go to Login History.

  2. Add the Authentication Method Reference (AMR) and Authentication Context Class Reference (ACR) columns to your view.

  3. These fields will show the authentication methods and context sent by your SSO provider.

  4. Compare the values in the AMR and ACR columns below to what is showing against your login attempts.

  5. If this is blank or not showing one of the below reference, you need to add these references via your SSO setup.

Tier Direct Salesforce Login (Salesforce MFA verifiers) SSO Authentication Method Reference (AMR) signals SSO Authentication Context Class Reference (ACR) signals Result
Phishing- Resistant MFA Security Keys (WebAuthn), Built-in Authenticators (Touch ID, Windows Hello), Admin-Generated Temporary Verification Codes cert, face, fido, fido2, fpt, hwk, iris, passkey, phr, pki, pop, pwlesspasskey, retina, sc, smartcard, smartcardpki, softwarepki, swk, tlsclient, x509 fido, fido2, fpt, hwk, passkey, phr, pki, pwlesspasskey, retina, smartcard, smartcardpki, softwarepki, swk, tlsclient, x509 Successful login
Standard MFA Salesforce Authenticator, TOTP Apps (Google/Microsoft Auth) mfa, mobiletwofactorcontract, okta_verify, pin, pgp, publickey, rsa, timesynctoken, user, vbm mfa, mobiletwofactorcontract, okta_verify, pgp, publickey, rsa, timesynctoken, vbm Successful login
Weak / No MFA No MFA pwd, sms, tel, email pwd, sms, tel, email Login blocked until enrollment and use of standard MFA verifiers