Salesforce is now requiring phishing-resistant MFA for Administrators and other Users with privileged access. Privileged access is defined as having View All Access, Modify All Access, Author Apex, and Customize Application.

As this gets rolled out, the most straightforward way to configure this is through passkeys. In this example, we will be walking through how to do this with passkeys through a password vault. However, if you use a U2F key or a built in authenticator like Windows Hello then the steps would be similar, but when prompted you would choose those corresponding options instead.

If you already have a password vault then it should support passkeys. Examples of password vaults that we see clients use include LastPass, BitWarden, and Keeper. Most, if not all, password vaults support passkeys as well.

Below is a guide on how to setup passkeys with a password vault. In this example, this will be with Zoho Vault, which is the password vault that we use internally. 

1. When logging in, you will be prompted for a passkey. The screen will look something like this.

2. You'll click Create Passkey. If you have a Password Vault, make sure to add the browser extension for it first. You can add this through the AppStore for your given browser whether that be Edge or Chrome. In my example, I'm using Zoho Vault. After I click Create Passkey, you'll see that a popup will appear on the side prompting me to add a passkey through it.

3. After you add the Passkey to your vault, you may be prompted to authenticate using that passkey. If you are, a popup will appear with that passkey prompting you to use it to authenticate.

Moving forward, when you login, you'll be prompted to Verify Your Identity with this new passkey similar to the screenshot below.