Said It Here

Why do privileged Salesforce users have to create separate passkeys?

Salesforce forces administrators and privileged users to set up platform-specific passkeys instead of letting them use their existing enterprise SSO and MFA providers like Microsoft Authenticator. This requirement prevents teams from maintaining a unified authentication workflow across all users.

What people tried

Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.

  1. 1
    Using the SOAP API instead of OAuth
  2. 2
    Setting up a Flow to set the ProfileId before a new user gets created

In their words

Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.

r/salesforce2 people · September 2026

“Normal users can authenticate using Microsoft Authenticator, but privileged users are being forced to create a separate Salesforce passkey.”source ↗

“Is a passkey or phishing-resistant MFA now mandatory for all privileged Salesforce users? Is there any supported way for privileged users to continue using Microsoft Authenticator push through Entra SSO without creating a Salesforce passkey?”source ↗

Parking_Management_1 · r/salesforce · 4 upvotes

“We have this all working just fine using the SOAP API, but since Salesforce is deprecating it, we need to switch to OAuth with an external client app... so we're doing that, but we get this error: "REQUIRED_FIELD_MISSING:user_must_have_one_entitlement_which_must_be_a_profileid"”source ↗

“The thing is, we ARE applying the "profileId" attribute and the correct ID is being used. Looks like other people have had this problem recently as well, but we don't know how to fix it”source ↗

MowAlon · r/salesforce · 3 upvotes

Where this came up

r/salesforceauthenticationpasskeyssalesforce

People with this problem also raised