Why do privileged Salesforce users have to create separate passkeys?
Salesforce forces administrators and privileged users to set up platform-specific passkeys instead of letting them use their existing enterprise SSO and MFA providers like Microsoft Authenticator. This requirement prevents teams from maintaining a unified authentication workflow across all users.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
Why do privileged Salesforce users have to create separate passkeys?
- 1Using the SOAP API instead of OAuthDid this help you?
- 2Setting up a Flow to set the ProfileId before a new user gets createdDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“Normal users can authenticate using Microsoft Authenticator, but privileged users are being forced to create a separate Salesforce passkey.”source ↗
“Is a passkey or phishing-resistant MFA now mandatory for all privileged Salesforce users? Is there any supported way for privileged users to continue using Microsoft Authenticator push through Entra SSO without creating a Salesforce passkey?”source ↗
“We have this all working just fine using the SOAP API, but since Salesforce is deprecating it, we need to switch to OAuth with an external client app... so we're doing that, but we get this error: "REQUIRED_FIELD_MISSING:user_must_have_one_entitlement_which_must_be_a_profileid"”source ↗
“The thing is, we ARE applying the "profileId" attribute and the correct ID is being used. Looks like other people have had this problem recently as well, but we don't know how to fix it”source ↗
Where this came up
People with this problem also raised
- 3How do you manage accounts and passwords that don't use SSO?
- 2Can multiple Windows users open a KeePass database?
- 2How to handle SSO and device management for local AD and M365?
- 5Fixing security token enrollment errors for non-technical users
- 6How to share MFA for a shared admin account
- 2Why does accounting software force logins for every company file?