Salesforce Privileged User
Passkey Requirement
Purpose, access review, and remediation procedure
Summary: Salesforce requires phishing-resistant MFA, commonly a passkey, for privileged users. The goal is to remove unnecessary privileged permissions from users who do not require them while preserving access needed for their job responsibilities. |
1. Background
Salesforce classifies a user as privileged when the user has the System Administrator profile or is assigned at least one of the following permissions through a profile, permission set, or permission set group:
Modify All Data
View All Data
Customize Application
Author Apex
A custom profile does not prevent this classification. If any of these permissions are included in the custom profile or granted separately, the user remains a privileged user and is subject to the passkey requirement.
2. Identified Issue
Some users with customized access have permissions that are broader than their actual job requirements. In the reviewed example, Customize Application and Author Apex were enabled. These permissions cause Salesforce to treat the account as privileged and require phishing-resistant MFA.
3. Remediation Procedure
Review the user’s access. Open the user record and identify the assigned profile, permission sets, and permission set groups.
Locate all privileged permissions. Check each access source for Modify All Data, View All Data, Customize Application, and Author Apex. Also verify that the user is not assigned the System Administrator profile.
Confirm business need. Before changing access, verify with the application owner or the user’s manager that the permission is not required for the user’s responsibilities.
Remove unnecessary permissions. Disable Customize Application and Author Apex when they are not required. Also remove View All Data or Modify All Data if either permission is present and unnecessary.
Save and retest. Have the user sign out completely and sign back in using a new browser session. Confirm that the account is no longer forced into the privileged-user passkey enrollment flow.
Document the change. Record which permissions were removed, where they were assigned, who approved the change, and the result of the login test.
4. Important Notes
Do not remove permissions only to bypass security. Permissions should be removed only when they are not required. Users who legitimately need privileged access must enroll in an approved phishing-resistant authentication method. |
Removing only Customize Application and Author Apex will not resolve the requirement if View All Data, Modify All Data, or the System Administrator profile is still assigned.
After a user is no longer classified as privileged, the mandatory privileged-user passkey requirement should no longer apply. Standard Salesforce MFA requirements may still apply, and Salesforce may still present passkeys as a recommended option.
Customize Application is a broad administrative permission. Removing it can affect configuration, object, field, layout, workflow, and application-management capabilities, so access must be tested after the change.
5. Validation Checklist
☐ User is not assigned the System Administrator profile.
☐ Modify All Data is not assigned unless required.
☐ View All Data is not assigned unless required.
☐ Customize Application is not assigned unless required.
☐ Author Apex is not assigned unless required.
☐ Permissions were checked in profiles, permission sets, and permission set groups.
☐ User completed a fresh sign-in test.
☐ Permission changes and approval were documented.
6. Salesforce References
Salesforce User Capabilities When “Customize Application” Profile Permission Is Granted
Knowledge Article 000386451
Prepare for Phishing-Resistant MFA Enforcement for Privileged Users, Including Admins
Knowledge Article 005321563