Salesforce Multi-Factor Authentication

Salesforce has enforced Multi-Factor Authentication since Fall 2022 - an additional verification step after your username and password. Covers the ways to meet it, including Cornell Two-Step Login with Duo, the custom domain link, verification codes and the Duo app, plus shared accounts, Pardot, integration and API logins, and sandboxes.

Added June 2026: Built-in Authenticator for Salesforce (Windows Hello or Touch ID)

• Salesforce Multi-Factor Authentication
• Use Cornell Two-Step Login
  • Use Custom Domain Link
• Verification Code
  • Authentication Method Set Up
  • Duo App
  • Existing Connected Authenticator
• Shared Accounts
• Pardot and MFA
• Integration and API Logins
• Sandboxes
• Resources:
• To Learn More:

Salesforce Multi-Factor Authentication

As of Fall 2022, Salesforce will enforce the Multi-Factor Authentication requirement to log in to their products.  Multi-Factor Authentication, or MFA, is an additional layer of security that requires you to provide a verification method after entering your username and password.  This is different than verifying your browser using a code sent via text or email.

NOTE: If you have not logged in to the Salesforce sandbox in more than a month, you should delete the sandbox entry form your MFA app and set it up again.

Use Cornell Two-Step Login

The easiest and most familiar way to meet the MFA requirement in Salesforce is to use Cornell’s CUWebLogin, which uses your Cornell NetId to log in, and Duo as your verification method.  

• Navigate to johnson.my.salesforce.com, and you will automatically be redirected to CUWebLogin to log in with your NetId and password.
• Verify your authentication method with Duo, through a phone call, passcode, or Duo Push notification.
• Bookmark johnson.my.salesforce.com to easily log in to Salesforce.

Use Custom Domain Link

You can log in to Salesforce through login.salesforce.com, which is also the URL certain products such as the Salesforce Mobile App and Dataloader use to authenticate users.  On the login screen, below the Login button, there is a link called Use Custom Domain.  Click that link, enter in johnson.my.salesforce.com, and click Continue. 

You will be redirected to the CUWebLogin screen to enter your NetId and password to log in, and to use Duo as your authentication method.

Verification Code

Sometimes the Use Custom Domain link is not an option (for example, in a Sandbox) and may require the use of a verification code prior to authentication.  In this case, you can connect the Duo app to you Salesforce account, or use a separate authentication app.

Authentication Method Set Up

If you have not yet set up an authentication method, you will be prompted to connect one to your Salesforce account.  Initially, you will be prompted to connect the Salesforce Authenticator.  That is an option, but you can also use the Duo app as your authentication method.

Duo App

Click the Choose Another Verification Method at the bottom of the screen.  You will be asked to choose a verification method, either the Salesforce Authenticator or a third-party authenticator app (such as Duo).  Choose ‘Use verification codes from an authenticator app’ and click Continue.

Open the Duo app on your device, press ‘Add+’, then ‘Use QR Code’.  Scan the QR code on your computer screen with your device. 

Add an Account Name and click Save.  Find the newly connected account in your Duo app and press it to see the passcode. 

Enter the 6-digit verification code from your Duo app into the box on your computer screen and click Connect.  You will now be logged in to Salesforce.

Existing Connected Authenticator

If you already have a connected authentication method, you will be prompted to enter a verification code after entering your Salesforce username and password.  Open your authenticator app, tap the Salesforce account, enter the 6-digit verification code on the screen, and click Verify.  You will then be logged in to Salesforce.

Shared Accounts

For shared accounts, MFA is still required, but there is a workaround that allows multiple devices to connect to the same user account.  Use the DUO app to connect to the shared account. 

NOTE: Salesforce Authenticator does not work for shared accounts.

1. Download the DUO app on the mobile devices of all users who have access to the shared account.
2. When logging in to the shared account for the first time after MFA is enabled, click ‘Choose Another Verification Method’.
3. Then choose ‘Use verification codes from an authenticator app’.
4. When you see the QR code, do not scan it with your mobile device. Instead, click ‘I Can’t Scan the QR Code’.  This will generate an authentication key.  Save that key.  All users who have access to the shared account will need that authentication key.
5. In the DUO app, press the Add + button.
6. In the search bar, find Salesforce, and press the Salesforce option.
7. You will see a box to enter an activation code. Enter the activation code from Step 4.  All users who have access to the shared account need to complete this step with the same activation code.
8. Click Next, then enter an account name. Click Save.  Then enter the 6 digit verification code from the Salesforce account in your DUO app.

Pardot and MFA

Pardot and Salesforce MFA

• Salesforce SSO with MFA enabled satisfies the MFA requirement.
• If not using B2BMA Integration User, may need MFA on connecting user. Pardot integration access will not challenge for MFA verification. 

Integration and API Logins

API logins & integration logins to Salesforce are exempt from this requirement.

Sandboxes

MFA is  required for all Salesforce Sandboxes.  Follow the steps above to set up MFA.

The MFA requirement does not impact any experience or site users.

Resources:

Manage Your Two-Step Login – this will require you to authenticate with your Cornell NetId.

Duo Guide to Two-Factor Authentication

To Learn More:

Salesforce Multi-Factor Authentication FAQ

Admin Quick Start Guide