Salesforce Security
Is your admin team ready for Salesforce's 2026 MFA enforcement?
Salesforce is tightening login security across every org through 2026. This is a forced change event for real users on a deadline, not an optional feature. The technology is the easy part. Getting your privileged users enrolled, your exemptions closed, and your people ready before login day is the change-management work Stony Point does.
The change: a forced event, not an optional feature
Three things are changing:
- MFA is enforced for employee users on every login, including through single sign-on.
- The older permission that let admins waive MFA for exempt users is going away, so anyone running on an exemption must be enrolled first.
- The Summer 26 release raises the bar further for privileged users.
Confirm your org's exact enforcement dates against Salesforce's published MFA enforcement schedule in Salesforce Help. We keep the framing here directional on purpose, because the precise dates are Salesforce's to set and to change.
Phishing-resistant MFA for privileged users
Users with elevated permissions are expected to use phishing-resistant MFA: a security key, a passkey, or a built-in platform authenticator such as Face ID, Touch ID, or Windows Hello, rather than an authenticator-app code alone. The elevated permissions in scope include:
- System Administrator
- Modify All Data
- View All Data
- Customize Application
- Author Apex
The precise scope and timing are set by Salesforce and roll out with the Summer 26 release; verify the current requirement for your org.
Why this is a change-management problem, not just an IT task
The risk is people, not technology: privileged users hitting a new login requirement (or getting locked out) on enforcement day, exemptions vanishing, and the sign-in flow changing without warning. That is the communications, adoption, and role-specific admin work Stony Point does.
Readiness checklist
Work these in order. Stony Point can run any of them with your team, or coach your admins to run them.
- Inventory who is affected: all employee users for baseline MFA, and separately every user holding an elevated permission who needs a phishing-resistant method.
- Confirm your org's exact enforcement dates against Salesforce's published schedule.
- Enroll any users relying on the exemption that is being removed.
- Choose and roll out authenticator methods, including phishing-resistant options for privileged users.
- Communicate the change to users ahead of time so login day is not a surprise.
- Give admins hands-on practice with the new sign-in flow before enforcement.
- After enforcement: shift to ongoing privileged-access hygiene and periodic review.
Get your admin team ready before enforcement
The window to prepare is short. After the near-term milestones this becomes post-enforcement cleanup and ongoing privileged-access hygiene. Talk to us now and we will scope the readiness work to your org.
Last reviewed: July 17, 2026. The exact enforcement dates are set by Salesforce and are not printed here as fact; verify them against Salesforce's published MFA enforcement schedule in Salesforce Help before making a decision.