Topic starter
26/08/2026 11:51 am
TL;DR: Salesforce will require phishing-resistant MFA for employee logins in sandbox environments starting June 22, 2026 and then phase enforcement into production on July 1, reflecting a wider shift away from legacy MFA for privileged access. The change reinforces that password-based and code-based methods no longer provide enough assurance when AI-driven phishing now dominates the attack path, according to Yubico.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “Salesforce enforces MFA for all employee logins: Here’s what you need to know”.
By the numbers:
- 86% of phishing attacks are now AI-driven, according to Yubico.
- Salesforce will enforce MFA in sandbox environments beginning June 22, 2026, according to Yubico.
Key questions
Q: What breaks when privileged users still rely on phishable MFA?
A: Phishable MFA fails when the attacker can trick a user into revealing or approving the second factor, which leaves privileged access exposed even though MFA is technically in place.
Q: Why do phishing-resistant factors matter more for administrators than for standard users?
A: Administrators have broader permissions, more recovery value, and a larger blast radius if compromised.
Q: What signs show that an MFA programme is still too weak for privileged access?
A: Weak signals include continued use of SMS, push, or TOTP for elevated roles, policy exceptions across SSO paths, and delayed backup authenticator enrolment.
Practitioner guidance
- Inventory privileged Salesforce identities Identify System Administrators, power users, and any elevated service or admin roles that authenticate into Salesforce through direct or federated paths.
- Replace code-based MFA for high-risk roles Move administrators and other elevated users onto security keys or built-in authenticators that satisfy phishing-resistant requirements rather than SMS, TOTP, or push approvals.
- Check SSO enforcement end to end Verify that the same phishing-resistant policy applies to both direct Salesforce logins and SSO-based access so exceptions do not reintroduce weaker authentication.
Bottom line: Salesforce's rollout shows that phishable MFA no longer provides enough assurance for privileged enterprise access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Phishable MFA is no longer a defensible control baseline for privileged access. Salesforce's move reflects a broader control reset: elevated users are too valuable a target for codes and push approvals that can be socially engineered. The practical conclusion is that access assurance for administrators now has to assume hostile phishing conditions as normal.
A question worth separating out:
Q: Should organisations prioritise phishing-resistant MFA over other identity projects?
A: For most enterprises, yes, when the goal is to reduce the most common account takeover path. It should be prioritised ahead of lower-value convenience changes because authentication weakness often becomes the first step in broader identity compromise and later governance failures.
👉 Read our full editorial: Salesforce’s MFA rollout shows phishing-resistant auth is now baseline