Disabling or resetting two-factor authentication for an individual user in Salesforce generally involves removing their currently linked verification method from their account detail page. System administrators frequently perform this administrative task when an employee switches mobile devices, loses access to a primary authenticator app, or encounters a locked login session that blocks daily operations.
Understanding Administrative Control Over Multi-Factor Authentication
Accessing User Records via Setup
Administrators navigate to the setup menu by selecting the gear icon located at the top right of the workspace interface. From there, choosing the administration sidebar and selecting the users directory reveals the complete list of active company accounts. Clicking directly on a specific employee name opens their comprehensive profile page, which displays all linked security credentials and active verification methods assigned to that individual.
Disconnecting Registered Verification Methods
Finding the active multi-factor verification status on the user detail page allows administrators to manage connected hardware tokens or software applications. If a person utilizes the mobile authenticator application, clicking the disconnect option removes that specific device from their profile record. For built-in hardware keys or security keys, administrators select the remove action inside the designated section located further down the user record page.
Permissions Required for Security Modifications
Performing these changes requires specific administrative privileges rather than standard user clearance levels within the organization. Individuals must hold the system administrator title or possess the explicit manage multi-factor authentication in user interface permission assigned to their profile. Without these specific authorization rights, the platform conceals the disconnect and remove controls to maintain strict data protection standards across the entire enterprise environment.
Behavior Following Method Disconnection
Once an administrator disconnects the existing verification device, the affected account undergoes an immediate security transition during the next login attempt. The platform recognizes that no active authenticator remains attached to the credentials and prompts the individual to register a new verification method. This mandatory re-enrollment process ensures that security standards stay intact while resolving immediate device access roadblocks for the user.
Executing Account Verification Updates Safely
Maintaining security integrity while adjusting user credentials requires careful verification of identity before clearing any active authenticator applications from the system.
| Management Action | Required Permission Level | Operational Result |
|---|---|---|
| Disconnect App | System Administrator or Manage MFA | Removes mobile token and forces re-registration |
| Remove Security Key | System Administrator or Manage MFA | Clears hardware token from user profile detail |
| Review Status Log | Read Access to User Management | Displays active authentication enrollment timestamps |
| Support Escalation | Salesforce Customer Support Contact | Addresses global enforcement or policy exemptions |
Essential Steps Prior to Making Changes
- Confirm the identity of the employee requesting the security reset through a secondary communication channel.
- Review active permissions in the Salesforce Help documentation to ensure proper access.
- Instruct the team member to prepare their new mobile device or security token beforehand.
- Monitor the subsequent login activity to verify that new security enrollment completes without errors.
Frequently Asked Questions
Can administrators completely bypass multi-factor authentication permanently?
No, Salesforce enforces baseline security requirements across modern enterprise environments. While individual verification methods can be disconnected to allow device resets, legacy permanent exemption permissions no longer automatically bypass the core multi-factor authentication mandate for standard UI log-ins.
What happens if a user loses their phone?
An administrator navigates to the user profile in setup and clicks disconnect next to the registered authenticator application. This action clears the lost device, allowing the employee to safely register a replacement smartphone during their next sign-in attempt.
How do users re-enroll a new device?
After an administrator clears the old token, the employee simply enters their username and password as normal. The platform automatically presents an interactive setup wizard guiding them through pairing a fresh authenticator application or security key.
Conclusion
Managing employee authentication settings helps maintain daily workflow continuity while preserving strong platform security. System administrators should coordinate directly with team members to verify identity before clearing or resetting any active hardware or software tokens on corporate accounts.
