Salesforce is introducing updated login security requirements that require System Administrators and users with certain elevated permissions to verify their identity using a passkey or built-in authenticator, such as Touch ID, Face ID, Windows Hello, a device PIN, or a physical security key.
This helps keep your data more secure while giving users a faster, easier way to verify their identity when logging in.
Admin Setup: Enable Passkey Login Options
A system admin will need to enable a few settings before users can register and use passkeys.
Go to Setup > Identity Verification.
Enable the following three settings:
Let users verify their identity with a built-in authenticator such as Touch ID or Windows Hello
Let users verify their identity with a physical security key (U2F or WebAuthn)
Allow passwordless login with passkeys
Click Save.
Once these settings are enabled, users can register a built-in authenticator or passkey from their personal settings.
User Setup: Register a Built-In Authenticator or Passkey
If your org has already enabled MFA and you have not registered a verification method yet, you will be prompted to register one the next time you log in. Follow the onscreen instructions.
If you are already logged in, you can register one manually by following these steps:
Go to your personal profile settings by clicking your avatar in the upper-right corner, then click Settings.
Go to Advanced User Details.
Scroll down to the Built-in Authenticators section and click Add.
If you do not see this option, your Salesforce admin has not enabled built-in authenticators for your org yet.
For security purposes, Rethink may ask you to log in again or verify your identity.
When prompted, click Register.
Your browser or device will ask you to verify using the method already set up on your device, such as:
Touch ID
Face ID
Windows Hello
Device PIN
Device password
Physical security key
Complete the browser or device prompt.
Give your built-in authenticator a recognizable name, such as “MacBook Touch ID” or “Windows Hello.”
Click Save.
Your passkey or built-in authenticator is now registered and can be used for future login verification.