How Does MFA Impact SalesForce Logins?

How Does MFA Impact SalesForce Logins?


If you want to establish a SalesForce connection within Sales Cookie, but your chosen SalesForce user account requires MFA (multi-factor authentication - also known as 2-factor authentication), authentication will fail. There are two ways to solve this problem.

Option 1 - Edit Existing Permission Set
  • Login to SalesForce as admin
  • Browse to Setup
  • Search for "Permission Sets"
  • Open the existing Permission Set applied to your chosen user account
  • Search for "Two" to locate permissions whose name starts with "Two" 
  • Select "Two-Factor Authentication For API Logins" in the autocomplete dropdown
  • Edit the existing Permission Set
  • Uncheck "Two-Factor Authentication for API Logins"
  • Save the existing Permission Set
    • Note: this will impact all assigned users



Option 2 - Create A New Permission Set
  • Login to SalesForce as admin
  • Browse to Setup
  • Search for "Permission Sets"
  • Create a new Permission Set
  •       We recommend cloning your existing Permission Set
  • Search for "Two" to locate permissions whose name starts with "Two"
  • Select "Two-Factor Authentication For API Logins" in the autocomplete dropdown
  • Edit the new Permission Set 
  • Ensure "Two-Factor Authentication for API Logins" is unchecked
  • Save the new Permission Set
  • Apply this new permission set to your chosen account

    • Choosing The Right Permission
    Do not confuse the "Manage Two-Factor Authentication in API" permission, with the similar-looking "Two-Factor Authentication for API Logins" permission. The permission which must be unset is called "Two-Factor Authentication for API Logins". 

    Allowing MFA For Web Logins
    It is perfectly OK to have "Two-Factor Authentication for User Interface Logins" checked as shown above. This will not affect API logins used by Sales Cookie. This allows you to continue using MFA for web logins, while allowing apps to connect without MFA.