# MFA methods, SSO signals and session security levels

*Platform Identity and Access Management Architect Study Guide · Access Management Best Practices · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/access-management-best-practices/mfa-methods-sso-signals-and-session-security-levels*

Which MFA method each user type needs under the 2026 enforcement, how an SSO identity provider proves MFA with AMR and ACR signals, and how Session Security Levels, the SessionLevel attribute and login flows decide whether a login yields a standard or high-assurance session.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Access Management Best Practices
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a set of requirements, determine the most appropriate methods of multi-factor authentication (MFA) to use, and the right type of session they should yield.

## What the exam expects

- Pick the MFA method tier a user needs from their permissions, and reject email, SMS and security questions for employees.
- Decide how SSO users satisfy MFA: the identity provider's MFA with AMR or ACR signals, or Salesforce MFA for the SSO provider.
- Configure Session Security Levels so the right logins yield a high-assurance session, including per-login control with the SessionLevel attribute and login flows.
- Recognize what MFA enforcement changes for integrations, API logins, exemptions and external users, and when to enable passwordless login with passkeys.

Key terms: **phishing-resistant MFA** (passkeys: built-in authenticators and security keys, or certificate-based authentication); **AMR/ACR** (signals in the SAML response or ID token naming the method used at the identity provider); **Session Security Levels** (Session Settings columns that map each login method to Standard or High Assurance); **high-assurance session** (the level sensitive operations can require); **step-up authentication** (raising a session by completing MFA).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Privileged users | System Administrator profile, Author Apex, Customize Application, Modify All Data, View All Data | [MFA Verification Method Tiers](https://help.salesforce.com/s/articleView?id=xcloud.mfa_security_tiers.htm&language=en_US&type=5) |
| Weak methods | Email and SMS don't satisfy any MFA requirement | [MFA Verification Method Tiers](https://help.salesforce.com/s/articleView?id=xcloud.mfa_security_tiers.htm&language=en_US&type=5) |
| Enforcement start | Sandboxes July 10, 2026; production July 20, 2026, by release group | [Prepare for MFA Enforcement](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1) |
| SSO login with no signal | Treated as no MFA; user enrolls in Salesforce MFA | [Prepare for MFA Enforcement](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1) |
| AMR `mfa` | Standard tier only, not phishing-resistant | [Prepare for MFA Enforcement](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1) |
| Default High Assurance method | Only Multi-Factor Authentication | [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US&type=5) |
| SessionLevel attribute | `STANDARD` or `HIGH_ASSURANCE` in the SAML assertion | [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US&type=5) |
| Temporary verification codes | Need a high-assurance session | [MFA and High Assurance](https://help.salesforce.com/s/articleView?id=xcloud.understand_mfa_high_assurance_login_session.htm&language=en_US&type=5) |
| Step-Up Authentication Period | Maximum 2 hours | [Require High-Assurance Session Security](https://help.salesforce.com/s/articleView?id=xcloud.security_auth_require_ha_session.htm&language=en_US&type=5) |
| MFA for API Logins | Requires the UI Logins permission; TOTP replaces the security token | [Multi-Factor Authentication for API Access](https://help.salesforce.com/s/articleView?id=xcloud.security_require_2fa_api.htm&language=en_US&type=5) |
| SMS MFA | External users only; Identity Verification Credits needed | [Use SMS for External Users](https://help.salesforce.com/s/articleView?id=xcloud.security_mfa_sms_for_external_users.htm&language=en_US&type=5) |

## Check yourself

- Why does an SSO login with no AMR or ACR value trigger Salesforce MFA enrollment?
- When should SSO users get a high-assurance session only after Salesforce MFA?
- Which setting lets employees log in with a passkey and no password?
- Why can't a login flow add a second factor to Data Loader logins?

## Sources

- [MFA Verification Method Tiers](https://help.salesforce.com/s/articleView?id=xcloud.mfa_security_tiers.htm&language=en_US&type=5)
- [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1)
- [Understand the Relationship Between MFA and a High Assurance Login Session (Salesforce Orgs)](https://help.salesforce.com/s/articleView?id=xcloud.understand_mfa_high_assurance_login_session.htm&language=en_US&type=5)
- [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US&type=5)
- [Require High-Assurance Session Security for Sensitive Operations](https://help.salesforce.com/s/articleView?id=xcloud.security_auth_require_ha_session.htm&language=en_US&type=5)
- [MFA with an SSO Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_thirdparty_idp.htm&language=en_US&type=5)
- [Set Up MFA with an SSO Identity Provider](https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_use_thirdparty_steps.htm&language=en_US&type=5)
- [Use Salesforce MFA for SSO (Salesforce Orgs)](https://help.salesforce.com/s/articleView?id=xcloud.mfa_sso_logins.htm&language=en_US&type=5)
- [Enable Passwordless Login with Passkeys](https://help.salesforce.com/s/articleView?id=xcloud.identity_passkey_login_enable.htm&language=en_US&type=5)
- [Multi-Factor Authentication for API Access](https://help.salesforce.com/s/articleView?id=xcloud.security_require_2fa_api.htm&language=en_US&type=5)
- [Use SMS as an MFA Verification Method for External Users](https://help.salesforce.com/s/articleView?id=xcloud.security_mfa_sms_for_external_users.htm&language=en_US&type=5)
- [Custom Login Flows](https://help.salesforce.com/s/articleView?id=xcloud.security_login_flow.htm&language=en_US&type=5)
- [Login Flow Examples](https://help.salesforce.com/s/articleView?id=xcloud.security_login_flow_examples.htm&language=en_US&type=5)
- [SessionManagement Class](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_SessionManagement.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams