Salesforce is enforcing new security requirements this summer.

In Salesforce, open Setup → Identity → Identity Provider Event Log (or Login History with the SAML Assertion / OIDC ID Token columns). Pick a recent SSO login for a privileged user and inspect the raw assertion. For SAML, look for an AttributeStatement whose Name contains amr or authnmethodsreferences, and an AuthnContextClassRef element. For OIDC, decode the id_token at jwt.io and read the amr array and acr claim. If neither appears, your IdP isn't sending them — no amount of Salesforce config will help until the IdP is fixed.

Confirm three things in order: (1) the user actually authenticated with a phishing-resistant factor at the IdP (passkey, security key, Windows Hello, Touch ID) — a fresh password + push does not count; (2) the IdP included that factor in the AMR/ACR claim on this specific login (check the assertion); (3) the value sent matches Salesforce's accepted list exactly, case-sensitive for AMR. A common failure is the IdP sending mfa only, which satisfies Standard MFA but is blocked for admins.

Okta does not include AMR or ACR in SAML assertions by default. Open the Salesforce app in Okta → Sign On → SAML 2.0 → Attribute Statements and add authnmethodsreferences with a value like appuser.authnMethodReferences (or a hardcoded hwk;fido2;phr for testing). For OIDC, enable the Include AMR claim option on the OpenID app and confirm claims like fido2, hwk, or phr appear. Use Okta's System Log → filter on Authentication of user via SAML/OIDC to see the assertion payload sent to Salesforce.

No. Okta Verify push and TOTP are Standard MFA (okta_verify, mfa) and are blocked for privileged users. Enroll the admin in FastPass with biometric + device-bound key, or a FIDO2 security key. In the Okta Authenticator policy, require Possession factor is hardware protected and Phishing-resistant for the Salesforce app.

Enforcing MFA in Conditional Access doesn't automatically send the AMR/ACR claim to Salesforce. In Entra → Enterprise Applications → Salesforce → Single sign-on → Attributes & Claims, add a claim named http://schemas.microsoft.com/claims/authnmethodsreferences sourced from user.authenticationmethods, and an authnContextClassRef claim. Then create a Conditional Access → Authentication Strength policy requiring Phishing-resistant MFA scoped to the Salesforce app.

Use the built-in Phishing-resistant MFA strength (passkeys, Windows Hello for Business, FIDO2 keys, CBA). Assign it to a Conditional Access policy targeting the Salesforce enterprise app and the group of privileged Salesforce users. Verify with a test admin: sign-in log → Authentication Details should show fido2 or windowsHelloForBusiness, and the outbound SAML/OIDC claim should include a matching AMR value like fido2 or hwk.

Salesforce splits SAML AMR attribute values on semicolons, not commas. Send hwk;fido2;mfa (semicolon separated) or send each value as its own <AttributeValue> element inside the same Attribute. URN- or URL-shaped values (e.g. urn:ietf:params:oauth:...:hwk) are additionally split on : and /, so the trailing token is what gets matched.

Setup → Users → Login History. Add the Authentication Method Reference and Login Type columns. For a phishing-resistant SSO login you should see a value from the accepted AMR list (e.g. fido2, passkey, hwk, wia). If the column is empty on an SSO login, the IdP sent nothing — the login will be blocked once enforcement begins.

Yes. In a sandbox, go to Setup → Identity Verification → Enable Phishing-Resistant MFA for privileged users. Have a test admin sign in via SSO and confirm the assertion contains a phishing-resistant AMR/ACR value. If it doesn't, the login is blocked immediately — that's your regression signal. Fix the IdP, retest, and roll the same claim configuration to production before July 20, 2026.