How Can Admins Reduce MFA Friction in Salesforce?

Today on the Salesforce Admins Podcast, we talk to Jay Hurst, Senior Vice President of Product Management, and James Ferguson, Senior Director of Product Management, at Salesforce. Join us as we chat about MFA step-up authentication and what it means for Salesforce Admins. You should subscribe for the full episode, but here are a few takeaways from our conversation with Jay Hurst and James Ferguson. Step-up authentication protects sensitive actions Starting next week, Salesforce is requiring all users to use Multi-Factor Authentication (MFA). If you're a privileged user like, for example, an admin, you'll need to use a phishing-resistant MFA. That's why I sat down with Jay Hurst, VP of Product Management, and James Ferguson, Senior Director of Product Management, to talk about why these changes are vital to protect your org's data. The first thing to know is that AI is making it easier than ever to launch targeted phishing attacks at scale. So while the MFA requirements provide a good first layer of protection, we want to make extra sure you are who you say you are before you're allowed to perform certain actions, like downloading a large number of records or running a big report. Phishing-resistant MFA uses a passkey, like a fingerprint or facial recognition biometric, to verify that it's actually you and not just someone with access to your email account. Balancing security with user friction As Jay and James acknowledge, these changes will add some friction to your users' experience. However, with the pace at which these kinds of attacks are evolving, it's more important than ever to get serious about your security posture. "We're trying to introduce a little more friction right now so that people start to think," Jay explains, "and start to build those habits of understanding when they're doing something that potentially could be considered a malicious attack, such as downloading that All Opportunities report." They're also building out compensating controls that should make things easier in the future, allowing you to trust users from a certain IP range, for example. Security is a journey, not a destination The most important thing to realize is that these requirements are about more than just jumping through some extra hoops. Phishing and man-in-the-middle attacks are growing more and more sophisticated, and you need better protections than "Well, that hasn't happened yet." Instead, James and Jay recommend viewing this as an opportunity to partner with other stakeholders in your org to develop a comprehensive security plan. As Jay says, "Security is a journey, not a destination. What is 100% secure today is not as secure tomorrow." The trick is to develop a security-focused mindset throughout your business that will protect you now and in the future. Make sure to listen to my full conversation with Jay and James for more on step-up authentication and how admins can reduce friction for users. And make sure you're subscribed to the Salesforce Admins Podcast so you never miss an episode. Podcast swag Salesforce Admins on the Trailhead Store Learn more Salesforce Admins Podcast Episode: What Are Security Essentials for Salesforce Admins? Salesforce Admins Blog Post: Securing Your Org: From Reactive to Proactive Salesforce Help Article: Prepare for the upcoming Step-up Authentication requirements on Report Actions Salesforce Help Article: Prepare for MFA Enforcement for All Employee Users Salesforce Help Article: Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins Salesforce Help Article: Security-Related Product Updates to the Salesforce Platform: User Identity, Data Protection, and Access Controls Admin Trailblazers Group Admin Trailblazers Community Group Social Jay on LinkedIn James on LinkedIn Salesforce Admins on LinkedIn Salesforce Admins on X Mike on Bluesky social Mike on Threads Mike on X Full show transcript Mike: This week on the Salesforce Admins Podcast, we're talking with Jay Hurst and James Ferguson from Salesforce Product Management about MFA step-up authentication and what it means for Salesforce admins. As you know, security isn't just a front-door login decision anymore. It's about protecting sensitive actions, understanding risk, and designing systems users can trust. So Jay and James are going to help us unpack phishing-resistant MFA, compensating controls, IP ranges, SSO, and why these changes matter in a world where data, automation and AI are all working together. For us Salesforce admins, this is a chance to think beyond features and really look at how we steward the entire system. So listen in, click that Subscribe button, and of course I would love if you could share it with fellow Salesforce admins or, hey, you know what? Let's make some friends in that security team. So with that, let's get Jay and James on the podcast. So Jay and James, welcome to the podcast. Jay Hurst: Thanks for having us, Mike. James Ferguson: Great to be here. Mike: Absolutely. Jay, let's start off with you. We kind of want to get to know a little bit about you, and James, we'll call on you second, but before we get into our topic today, can you just tell me a little bit about how you got to Salesforce and what you do? Jay Hurst: Sure, yeah. So I have been with Salesforce for almost 22 years now. I started in our customer support department, one of the first 12 phone support reps here at Salesforce. Did that for a couple years and helped found our Tier 3 organization in support. Eventually moved over to our customer-centric engineering department, stayed in there for a while. And then in 2012, had an opportunity to join the product management group for platform, and I moved over and ran a team called Force.com Canvas. And for the last, I guess, 12-ish years now, I've been kind of weaving my way upwards through platform. Currently, I lead our platform services subcloud, so all of the core foundational pieces of platform that you might think of are schema and metadata, APIs, eventing systems, connectivity systems, and also our identity area, which is what brings us here today to talk about MFA. Mike: Yeah. Boy, flashback. You called it the Force.com platform. Jay Hurst: Well, that's what it was called back then. Mike: I know. I know. Jay Hurst: And I can't remember all of the names we've had for it. Mike: Oh, that's okay. I'm sure there's a website that tracks all of them. Jay Hurst: I'm sure there is. Mike: James, fill us in. How'd you get to Salesforce, and what do you do here? James Ferguson: Well, I am, I guess compared to Jay, one of the newer members of the team. I've only been at Salesforce for about 16 and a half years, almost 17 years. Pretty much entirely on the platform product management side, working on various things people know and love like sharing and big objects and event monitoring and those things. And most recently I've taken over responsibility for the identity product team, responsible for all the login and auth and SSO and all of the wonderful things we'll talk about today. Mike: Oh, wow. Okay. So then just to be clear, I'm actually the newest person on this call. I've only been at Salesforce for a little over 12 years now, so I guess I still have my rookie stripes. Jay Hurst: Combined we're almost at 40, or just over 40. Mike: Yeah, combined. We almost get our AARP discount, right? Jay Hurst: Yeah, exactly. Mike: Jay, let's kick off. I know I did a podcast ... and I'll link back to it ... not that long ago with Laura Pelke talking about some of the new things that were coming out, and of course security is always big on admins' mind. She did a wonderful job of explaining step-up authentication to me, which was basically the airport analogy of you have to show your ID to get in and then you have to show your boarding pass to get onto the plane. I thought that really made sense to me, but let's talk about the new authentication that's coming out, if you call it that, and the new step-up concerns that Salesforce admins have. Jay Hurst: Sure. So I think as we move into the continued proliferation of agents and AI across the industry, security is obviously top of mind for a lot of our customers and for Salesforce as well, specifically because we have to help protect our customers. And so when we're thinking of that and how we ensure our customers' data is protected, with step-up authentication, it's really focused around in that same analogy, making sure you're providing your boarding pass at the right times when you're doing things. So just like you need to show your boarding pass when you go through the TSA gate and when you're on the plane and probably to the gate agent after you're on the plane, when you're doing certain things within Salesforce, we want to make sure you are who you actually are and your session hasn't been compromised. So when you're doing certain higher sensitivity-type actions such as I want to download 10,000 records out of my system, maybe run a report, putting that end user through another verification of, "Hey, is this actually you? Prove it with your step-up," so that we have that confidence that we can release the records. And so this kind of helps prevent some of those man-in-the-middle phishing attacks where somebody gets you to log in and then steals your credentials or steals your session in the background. So it's kind of that second or third or fourth level of protection in the runtime. Mike: Wow. James Ferguson: I think that's an important shift that's worth calling out, because it's no longer about just putting a stronger lock on the front door and making sure somebody has better passwords, or even the later stuff, the more recent stuff with verification. But it's when sensitive things happen, we need to do a little extra even once you're inside the airport, if we want to continue that analogy. And so it's a shift from that front door to moving forward. Mike: Yeah. James, help me understand that a little bit more, because I think one of the things that admins always fight is user friction. How hard is it to do something? And now we're introducing something when it could disrupt their flow of work, but it's for a good reason. James Ferguson: Exactly. I would say that we are constantly balancing that. We're constantly balancing the need for security with the friction it does. And so we aren't expecting to do every click, for example, but just when you're exporting data from a report, which is potentially pulling a large amount of data out, we want to make extra sure. We're looking at some other things in the future around maybe when you're an admin changing some security configurations, we want to make sure you are who you are. And frankly, you see this more and more even in consumer websites where sometimes you're asked. If you're going to change a phone number, change a thing, you need to go back and sort of double-proof who you are. But it is a trade-off. It is a trade-off. Mike: Yeah. It's like once you're logged in, it's, "Oh, if you're going to change." I was trying to order tacos the other day through an app and I needed to update my credit card. And then right after I did that, they're like, "And you need to put your password back in." I'm assuming that was kind of the same situation. James Ferguson: Kind of the same situation. Jay Hurst: Yeah, exactly. Exactly. Yeah. And the other thing I'll add to this too is on the friction point. We always have to balance that. Like James said, we don't want people to become overly frustrated and not want to use Salesforce because it has too much friction. But the reality is over the last 20 years, we've edged so far on the line of not causing any friction that we've led admins down the path of not having that understanding of what their users are doing, and really not getting into that proper security-conscious mode. So we're trying to rubber band a little bit back on the other side, introduce a little more friction right now, so that people start to think and start to build those habits of understanding when they're doing something that potentially could be considered a malicious attack, such as downloading that all-opportunities report. So starting to get customers to think through that while we are continuing to build out what we call compensating control. So the end goal here is not to provide friction and it's not to force you to do these one-time passwords for everything you need to do in the system. It's to give admins that layered capability of saying, "Well, if I have these five or six different controls I can put into place, then they can kind of compensate for one another." So where the most friction might be having to open up your email to get that one-time password to do the step-up, maybe we can compensate that through things like having a trusted IP range or already having a phishing-resistant authentication put in, or other controls that we will layer in. So we ultimately get to a posture where the admin can both reduce friction while choosing the proper set of controls for their needs. Mike: Yeah. No, that makes sense. You mentioned phishing-resistant MFA. Can you help me explain that if somebody's never heard that before? Jay Hurst: Yeah. So maybe I'm going to try and wiggle this airport analogy in. If we think way back in the day when you had your IDs, before REAL IDs and all of this, you didn't actually have good authentication on them. You might have a really bad picture, or in some cases IDs didn't have any pictures on them. They just had your name and your information, but they were accepted. Now, the problem with that is anybody could steal it if it doesn't have your picture, and they can pretend to be you. So phishing-resistant MFA is kind of that same thing. Where a normal MFA might be a one-time password on your phone where you get that push notification that says, "Hey, your code is 123456, enter that code in," that's great because it means you have to have your phone in order to get that one-time password, but it's not as secure because it's sent over SMS. It doesn't really verify that you are who you say you are. It's only that you have access to that phone. Phishing-resistant adds another layer on top of that, so it's not just over SMS or in an app. It would be through what are called passkeys or other more cryptographically secure passes. So think of your face ID, your touch ID, some of those passkey-type implementations that you might see, where it's not just getting a code, but you have to unlock a vault that has your information in it and then you provide that information out. So it's taking it from that ID that anybody can use if they just happen to steal your wallet into more of a REAL ID that also has some biometrics attached to it. So you can actually guarantee it's not just that you have the thing, but you have the thing and you are the person that should have the thing that identifies you. And so that's what we're implementing today that's starting to roll out tomorrow in production. We've already started pushing it into sandbox for admins where we want all of our administrative users across the system to enroll and use these phishing-resistant MFA capabilities, so that they're more secure. Mike: Yeah. I never even thought of that. All the time there's apps I log into and they send me a one-time passcode and I'm like, "Well, of course I have access to it." Never did I think that, "Oh, what if somebody already has access to my email, requests that code, and now they're essentially spoofing me?" And it never dawned on me until you think of, well, they're not really verifying that it's you, Mike. They're just verifying that whoever requested that code also has access to your inbox. And you're like, "Oh." Jay Hurst: Exactly. And that may not be a nice person. Mike: Right. So James, what are some questions that admins are asking online that we can kind of help answer for them, or equip them for when they get this rolled out to them? James Ferguson: They're certainly asking questions about phishing-resistant MFA versus regular MFA and the different sort of authenticators that are out there. I'll shift this around a bit. One of the things they aren't asking about, it's actually something that Jay mentioned in passing, which is the alternate controls. And for things like step-up, if you have login IP ranges on the org or on the user profile, or there's some session settings which force you to always be coming from the same IP address in your session, which is the case for most of us who are at a laptop at work or whatever it is. Those avoid step-up entirely because we have more certainty about who you are and where you're coming from. If your session's bouncing between Eastern Europe and Middle East and North Carolina and keeps hopping around, we start worrying more. So you can do some things around IP ranges, which takes that friction away from the user altogether, and so those are some of the things that I would encourage admins to look into. Now, sometimes it doesn't work because of mobile providers or other network infrastructure, but it's also potentially a low-calorie way of really sort of avoiding at least the step-up part. They'll still have the MFA requirements. Jay Hurst: And one thing I'll add to that. When we add these types of controls to ... admins are human like the rest of us and we always want to make it as frictionless and easy as possible, but we don't want to trade off the security for it. So IP ranges specifically have been a little bit of our bane for the last six months, because we have a lot of customers who have said, "Well, I will just put in the entire internet range of IPs and go 000 to 255, 255, 255, 255. And then no matter where I'm coming from, I'm not going to get challenged and it's going to be great." And that works, or worked, but it's not secure. And so we don't want to trade off security for just checking the boxes. There are reasons for us doing this. Now, with that one specifically, we have put in changes in place where we won't let you use such a broad internet range to get around it in that respect, where you actually have to put though into like, "Well, what is the internet range that I'm actually coming from and using?" And we have some friction still with that, I would say, with admins using very global deployments or salespeople that travel around a lot and using different VPNs. So we're working through that as one of those compensating controls rather than the primary control. But again, it is up to all of our admins to really think through. We don't want you to just do the check the boxes that we're telling you to check because we want you to check a box. We really want you to think about these changes and what it means to your organization, why we're actually trying to implement these, and ultimately determine what makes the most sense for you and your company. And include your security officers and your CISOs to really validate what meets the requirements that your company has, so that everybody is protected both from a security perspective and ultimately a legal perspective as well. Mike: Yeah. No, absolutely. I mean, we did a security day at TDX, our team did, and we had a CISO in there and a Salesforce admin as one of the kind of breakout topics, and they were in lockstep with each other, and I've always said that. I remember the instance I was managing, once it grew beyond 10 users, I was like, "I really need to figure out what our security posture is and who's in charge of this, who sets password complexities," at the time and stuff like that, and it's not adversarial. It's you want to be in alignment with what the rest of the company's doing and also fall in line if there's a SSO requirement. Boy, I was quick to jump on that, because it also made logging in simpler for my users. Jay Hurst: 100%, and that's the other side of this. All of these things do play with SSO. If you have implemented SSO that has phishing-resistant capabilities already built into it, great. We will take advantage of that from the Salesforce side. We'll trust your provider. We'll trust that your security team has already set up what is needed for your company and we'll let you log in. So we don't want to add these additional duplicative type of controls for you, but we also recognize that a lot of our customers, maybe they're smaller customers, maybe they're not the enterprise size of Salesforce and don't have as structured of a security posture. So in those cases, we want to partner with our customers and really help them define what this should look like when they're thinking about internet security and their data in the cloud. Mike: Jay, I'm going to continue with you because James brought up a really good point. I was thinking of, "I'm going to ask him the common questions that admins are asking online." And James, you flipped the script, and it's, "Well, here are the questions that worry us that they're not asking." Jay, I'd ask kind of the same question to you, is you've seen a lot of the questions that our community's asking online. What are the questions they aren't asking that you really hoped they would ask, or you're there to provide an answer for? Jay Hurst: Yeah, I think the biggest ones, James talked about the compensating controls. That's a good one. I think a lot of our customers, as they're approaching it from the first standpoint is really they're looking at this as a Salesforce tax. They're really looking at it as like, "Oh, gosh, this is another thing Salesforce is putting me through. I don't know why. Why don't you just let me get my job done?" That type of attitude, which is completely understandable, but I do think one of the things our admins aren't seeing at that first cut is really the threat landscape that exists out there. I think if you haven't been attacked, if your org hasn't been compromised, it's very easy to fall into complacency and just think, "Everything's perfect, I'm secure, nothing's going to happen." And like everything, security and protection is a spectrum and it's a journey. You are never 100% perfectly ready for every outcome, and you also can't assume that what worked yesterday will continue to work tomorrow. So what I would love to see more of our admins and customers look through is how do I build the security and the continuing advancement of my security posture into my day-to-day, into my development scenarios, into my admin scenarios, where the first thing we should always be thinking about is, "Is this change I'm doing helping or degrading my security posture? And if it's degrading, how do I increase it? What do I do to make it better?" So I would love to get to a point where our very wonderful and vocal admins out there are also pushing us to do even more things to help protect them. What are the other controls that they're seeing across other enterprise systems that they want to take advantage of? How can Salesforce make it easier for you without lowering that security posture? How can we make it so that the friction can be lowered faster because you acknowledge the acceptance of the controls, or something like that around really getting back to a true partnership with more of our customers that I wouldn't say we've lost, but it's easy to forget about when you're focused on the headless 360s of the world or how can I get more agents into my system. And we also still have to think about, "And how do I keep it protected and managed?" Mike: Right. Yeah. I mean, it's more people in your house, but also making sure that everybody shuts the door and locks it. Jay Hurst: And wipes their feet. Mike: Right. Takes shoes off. James Ferguson: I think Jay also touches on what maybe I would consider the elephant in the room, because I think, when going back to the original question you asked in terms of what are admins asking, most of them aren't asking the why. Most of them acknowledge the value of these things and the need to do it, but they do push back on the why immediately and why under these compressed timelines and why, and sort of those kind of questions. And I will acknowledge that the rollout of some of these controls has not been as smooth as we all would've hoped, and so there's been some schedule things bouncing around from a timing perspective, and so we're definitely working on all of that. But it does play to that level of risk, and these are the things we really felt we needed to roll out sooner rather than later, and so that's why some of these timelines are compressed. I will add another, the flip side of that, to your point about what should admins be doing. We do find when we give notice, of like advanced notice of asking people to change things, they tend not to do it until the week before the enforcement date. Mike: Imagine that. Procrastination? Come on, now. James Ferguson: And so that's sort of, when our executives are looking at adoption rates or whatnot, it's sort of blunted. The desire to extend those out is blunted because, well, people are just going to wait anyways. But that said, I don't want to sort of ... We are pushing fast. We acknowledge that. We are making people a bit even uncomfortable, I would say. And we acknowledge that, but this is something, again, in the balance of the security posture we feel is important for the overall trust in the Salesforce platform and product. Mike: I mean, the one thing that I've always learned through all of the work that I've done with various teams at Salesforce is for every time you roll something out, another lock, there's always 10 people there trying to pick it, if they haven't already picked it. And so you both have mentioned that unfortunately it's compressed timelines, but it's timelines because we need to make sure that you're building locks and putting that stuff in place before people just have it to where they can blow through it, you know? Jay Hurst: Absolutely. The best defense is a good offense, I think is a very adequate app saying in this instance. We want to continue to make sure everybody is at a baseline security level, which is the phase we're in right now. It's this horizon zero of how do we get everybody to the minimum baseline, where we feel very comfortable that your data is going to be protected on the Salesforce platform? And it is painful, and it will be painful for the next couple months as these changes really roll out. Once we get there, we start thinking about what's our horizon one and our horizon two look like where we can start to add in the extra controls, give customers more levers to pull for their specific use cases, really focus on the experience around this, because I will also fully admit and not try and gloss over the fact that sometimes the wordings of things in the UX that we provide you to turn them on and turn them off is confusing and it's not as easy as it should be, and we're sacrificing some of that ease of use right now for speed of deployment. But the efforts that we have with the Salesforce Trust platform, which is an expanded group that we now have here that is purely focused on how do we not just get everybody secure, but continue to add more and more security features to make sure that Salesforce is the premier example of how an enterprise SaaS company secures their customers' data. So that is the journey we're on, and we're taking our customers with us. And as painful as it is, James and myself and the whole team here, we are looking for active feedback. We're engaging with the community on a day-to-day basis just to try and sand down these rough edges as much as we can until we can get the front door built, locked, and then we can really talk about how do we decorate our house now. Mike: Yeah. But also you mentioned, well, we're doing it and it's going to be painful. I guess I'm on the flip side of that, thinking, "Boy, if I had other applications and they're not going through this as well, that actually is more of a red flag to me," because then now I'm thinking like, "Well, do they not care as much about making sure all of my data on their platform is as secure as possible?" Jay Hurst: Absolutely. Like I said, it's a journey, not a destination. What is 100% secure today is not as secure tomorrow. With all of the new attack vectors that come out and these capabilities like Mythos and Fable and all of these really, really smart and frankly scary AI capabilities, we have to double and triple down even harder to make sure that we stay as far ahead of that as we can. Mike: Right. And as I've been reminded, security isn't always about being scary. Security is about being informed and making the right choices so that you have that protection and that understanding, which is really good. James Ferguson: It's risk management. It's risk management. Mike: Yeah, absolutely. James and Jay, I want to thank you guys for coming on and walking us through some of this. I know anytime that we offer anybody in our community, whether it's developers or architects or admins, a change, it's always extra work. But I feel like you're right there in answering the questions and helping through some of the hard parts, because I'll be honest, there's not a day that goes by that I don't learn something in security, at my current job and even when I was a Salesforce admin. Jay Hurst: Absolutely. And thank you, Mike, for helping amplify the message. One of the challenges I think we have at the product side is making sure our customers understand and get the information. We have our blog posts and our help documentation and we send out emails, but any extra we can do to megaphone this and get people aware is definitely valuable, so thank you for this opportunity. Mike: You bet. James Ferguson: And thank to all the admins who are out there who are also helping amplify this and helping support the rest of the community. It's one of the great things about Salesforce from the very beginning. It's the huge community support that exists. We couldn't do it if it was just the six PMs on my team. We need everybody involved. Mike: Yeah. And I think the part of that you take away is while I'm glad there's so many questions online that we had the idea to do this podcast, because that means there's so many people that are engaged and caring, as opposed to rolling something out and, "Hey, did anybody have any questions," and it's crickets. The reverse of that would also be kind of scary too, is there's questions because people care and because they want to understand. And also I think the one thing that I always had to do as an admin was I had to translate all of that from whatever the document said, or the podcast like this or the blog posts, to my users and to my executives, and it's a lot different once you have to take something in and digest it and then be ready for a Q&A. So there's always more to learn, but thank you guys for coming on. We'll definitely have to have you back on. Jay Hurst: Sounds great. Mike: Talk more security. James Ferguson: Appreciate it. Looking forward to it. Mike: Big thanks to Jay and James for helping us understand MFA step-up, phishing-resistant authentication, and the role admins play in protecting business systems. Now, of course, we know security is a shared responsibility, and admins are right in the middle of making it real for users, executives and, well, everybody in the organization. So be sure to listen, subscribe and share this episode out, and work through those security changes. You got this. Don't worry. Until next time, we'll see you in the cloud.