salesforce Say hello to Einstein GPT
Contact Us 1-800-596-4880
  1. Homepage
  2. Access Management

  3. Multi-Factor Authentication

About Multi-Factor Authentication

Multi-factor authentication (MFA) provides an additional layer of verification for Anypoint Platform users. By default, MFA is required for all user accounts except accounts that use single sign-on (SSO). However, as an organization administrator, you can exempt specific user accounts from the multi-factor authentication requirement in order to allow existing integrations to continue operating without interruption. SSO users should configure multi-factor authentication through their identity provider.

Users must verify their Anypoint Platform credentials using at least one of four verification methods:

  • Third-party TOTP authenticator apps

  • Built-in authenticator

  • Security key

  • Salesforce Authenticator

Multi-factor Authentication Requirements for Salesforce and MuleSoft Products

  • Beginning February 1, 2022, MFA must be enabled for all of your Salesforce users. To learn more about this requirement, see the Salesforce Multi-Factor Authentication FAQ

  • Beginning October 29, 2022, all non-SSO accounts that do not have MFA configured or are not on your organization’s exemption list are prompted to configure MFA when they log in to Anypoint Platform.

Multi-Factor Authentication Verification Methods

You can configure at least one of the following verification methods to comply with multi-factor authentication requirements:

Third-party TOTP authenticator app

Registers an authenticator app to create verification codes that you provide when logging in to Anypoint Platform.

Built-in authenticator

Registers a physical authentication device, such as Touch ID or Windows Hello, to verify your identity when logging in to Anypoint Platform.

Security key

Registers a USB security key, such as Yubico YubiKey or Google Titan Security Key, to your account. The device is then authorized to create verification codes that you provide when logging in to Anypoint Platform.

Salesforce Authenticator

Registers the Salesforce Authenticator mobile app to create verification codes that you provide when logging in to Anypoint Platform.

Exempt Users from Multi-factor Authentication

To prevent service disruptions, identify any accounts (service accounts) that are used to programmatically call Anypoint Platform. However, it is best to use the Connected Apps feature to authorize apps to make programmatic calls to Anypoint Platform instead of using service accounts. Using the Connected Apps feature provides more security and control than using user accounts.

To exempt individual accounts from multi-factor authentication:

  1. Log in to Anypoint Platform using an account that has the Organization Administrator permission.

  2. In the navigation bar or the main Anypoint Platform page, click Access Management.

  3. In the Business Groups menu, select your root organization.

  4. In the Access Management navigation menu, click Identity Providers.

  5. Click the name of the identity provider (or IdP) for which you want to manage multi-factor authentication.

  6. In the Exempt Accounts section, add the accounts that you want to exempt.
    Only users who do not use single sign-on (SSO) appear in this list.

  7. Click Save.
    The exempt user accounts appear in the Exempt Accounts section.

You can later remove user accounts from the Exempt Accounts list by clicking X next to their account names.

Manage Multi-Factor Authentication for Your Account

You can modify the verification methods that you use to log in. You must register at least one method to use MFA.

To modify verification methods in your account:

  1. Log in to Anypoint Platform.

  2. In the Anypoint Platform navigation bar, click the circle icon that contains the initials associated with your Anypoint Platform account.

  3. In the drop-down, click Profile.

  4. Click Configure multi-factor authentication (MFA).
    The Manage Your Verification Methods interface appears.

  5. If you want to register an additional verification method:

    1. Next to the verification method you want to configure, click Add.

    2. Follow the instructions to configure your preferred verification method.

    3. Click Done.

  6. If you want to modify the name of an existing verification method:

    1. Click the pencil icon next to the verification method that you want to rename.

    2. Enter a new name for your verification method.

    3. Click the checkmark.

    4. Click Done.

  7. If you want to remove a verification method:

    1. Next to the verification method you want to remove, click the bin icon.

    2. Click Yes

    3. Click Done.

      If you have removed all verification methods, you must configure at least one verification method before you save your changes.

  8. Click Save.

Reset Multi-Factor Authentication for Individual Users

You can reset multi-factor authentication for individual users if a device is compromised or lost. If you are the only organization member with Organization Administrator permission and have lost access to your verification methods, contact customer support.

To reset multi-factor authentication for an individual user:

  1. Log in to Anypoint Platform using an account that has the Organization Administrator permission.

  2. In the navigation bar or the main Anypoint Platform page, click Access Management.

  3. In the Business Groups menu, select your root organization.

  4. In the Access Management navigation menu, click Users.

  5. Click the user whose multi-factor authentication configuration you want to reset.

  6. Click Reset multi-factor authentication.

  7. Click Confirm reset MFA.
    Next time the user logs in to Anypoint Platform, they are prompted to configure a new verification method.

View on GitHub