MFA methods, SSO signals and session security levels
Which MFA method each user type needs under the 2026 enforcement, how an SSO identity provider proves MFA with AMR and ACR signals, and how Session Security Levels, the SessionLevel attribute and login flows decide whether a login yields a standard or high-assurance session.
Given a set of requirements, determine the most appropriate methods of multi-factor authentication (MFA) to use, and the right type of session they should yield.
~8 min read · 13 practice questions ·
What the exam expects
- Pick the MFA method tier a user needs from their permissions, and reject email, SMS and security questions for employees.
- Decide how SSO users satisfy MFA: the identity provider's MFA with AMR or ACR signals, or Salesforce MFA for the SSO provider.
- Configure Session Security Levels so the right logins yield a high-assurance session, including per-login control with the SessionLevel attribute and login flows.
- Recognize what MFA enforcement changes for integrations, API logins, exemptions and external users, and when to enable passwordless login with passkeys.
Key terms: phishing-resistant MFA (passkeys: built-in authenticators and security keys, or certificate-based authentication); AMR/ACR (signals in the SAML response or ID token naming the method used at the identity provider); Session Security Levels (Session Settings columns that map each login method to Standard or High Assurance); high-assurance session (the level sensitive operations can require); step-up authentication (raising a session by completing MFA).
Key facts
- Detail
- System Administrator profile, Author Apex, Customize Application, Modify All Data, View All Data
- Detail
- Email and SMS don't satisfy any MFA requirement
- Detail
- Sandboxes July 10, 2026; production July 20, 2026, by release group
- Detail
- Treated as no MFA; user enrolls in Salesforce MFA
mfa- Detail
- Standard tier only, not phishing-resistant
- Detail
- Only Multi-Factor Authentication
- Detail
STANDARDorHIGH_ASSURANCEin the SAML assertion
- Detail
- Need a high-assurance session
- Detail
- Maximum 2 hours
- Detail
- Requires the UI Logins permission; TOTP replaces the security token
- Detail
- External users only; Identity Verification Credits needed
Sources for this section (7)
- MFA Verification Method Tiershelp.salesforce.com (opens in a new tab)
- Prepare for MFA Enforcementhelp.salesforce.com (opens in a new tab)
- Modify Session Security Settingshelp.salesforce.com (opens in a new tab)
- MFA and High Assurancehelp.salesforce.com (opens in a new tab)
- Require High-Assurance Session Securityhelp.salesforce.com (opens in a new tab)
- Multi-Factor Authentication for API Accesshelp.salesforce.com (opens in a new tab)
- Use SMS for External Usershelp.salesforce.com (opens in a new tab)
- Why does an SSO login with no AMR or ACR value trigger Salesforce MFA enrollment?
- When should SSO users get a high-assurance session only after Salesforce MFA?
- Which setting lets employees log in with a passkey and no password?
- Why can't a login flow add a second factor to Data Loader logins?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (13 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams