Salesforce Security Basics: What MFA Didn’t Lock

Salesforce locked the front door in 2026. Who else has a key?

What Salesforce security basics should every org have? Four things: MFA, active users only, intentional access, and alerts when data leaves. Salesforce now enforces MFA for you. The other three are on you.

Here are 8 questions to ask your team, and what a good answer sounds like.

Key takeaways

• MFA is now the floor, not the finish line. Salesforce enforces it for all internal users in 2026. Your exposure has moved to apps, integrations and AI agents.

• Review non-human users like you review people. Integrations, connected apps and Agentforce agents hold keys to your data, so their access needs the same regular check.

• The mistake to avoid: thinking "it won't happen to us." One compromised app in 2025 put over 700 organizations at risk.

1. What are the Salesforce security basics every org needs?

Six controls cover most of the risk:

• MFA for every login, and phishing-resistant MFA for admins

• Active users only: no former employees, no shared logins

• Intentional access: powerful permissions like View All Data and Modify All Data go only to people and systems with a clear business reason

• Reviewed integrations and connected apps, each with the narrowest access that works

• AI agents scoped like new hires, not like admins

• Monitoring for big exports and unusual logins

2. Doesn't Salesforce handle security for us?

Salesforce handles a lot, and in 2026 it took on more. It now enforces MFA for every internal user and phishing-resistant MFA (security keys, Face ID or Touch ID) for admins and other powerful users (Salesforce Admins). It also blocks logins from anonymizing VPNs, freezes users when a login looks suspicious, and asks for extra verification before report exports.

It also gives you free tools to check your own setup:

• Health Check scores your security settings against Salesforce's recommended baseline.

• Login History shows who logged in, when and from where.

• Setup Audit Trail shows who changed what in Setup.

What Salesforce can't decide for you is who should have access to what. That part is yours.

3. How long does a Salesforce security review take?

The first look takes minutes. Our free Salesforce Security Audit is a self-paced questionnaire that returns a graded report.

The fixes take days to a few weeks. What changes the timeline: how many integrations you run, whether you have a customer portal, and how long since anyone cleaned up users and permissions.

4. Is our org too small to be a target?

No. In August 2025, attackers stole tokens from one connected app, Salesloft Drift, and reached over 700 potentially impacted organizations (CyberScoop). They went after the app, and every org connected to it came along.

Small teams carry more risk, not less. One admin wears five hats, and access reviews never make the calendar.

5. Is everyone who can log in still supposed to?

Ask for the count of users who haven't logged in for 90 days. A good answer is a number and a date it was last cleaned up.

In client orgs we've found 50+ active users who had left the company or never logged in. Some didn't know they had a login. At another client, 20 people shared one login. Nobody could tell who did what, and shared logins break the Salesforce contract.

6. Who holds the keys to everything?

Make sure every System Administrator, Modify All Data and View All Data permission is there on purpose. Each one should belong to a person or system with a current business reason. If nobody can explain why it's there, remove it.

This applies to systems too. At one client, an integration was running as a System Administrator with Modify All Data. Anyone holding its credentials could read or change any record. We moved it to a Salesforce Integration user license with access to only the objects it needed.

7. Which apps and AI agents can reach our data?

Apps and AI agents can hold more access than any single employee, so they need the same review.

• Connected apps: One client had installed apps that no active user was using. The apps still had read and write access to dozens of objects, so we removed them. Salesforce now blocks uninstalled connected apps for most users, and since Spring '26 new connected apps are off by default. Apps approved before that still need a review.

• Agentforce agents: Each agent runs as its own Agent User with its own permissions. If it serves customers, it should only see that customer's records. Treat an agent like a new hire: no broad access on day one.

8. Would we know if someone exported our customer list?

Ask what alerts fire on a large export or a login from a new country. A good answer names the alert and who gets it.

Salesforce now asks for extra verification before report exports, and Event Monitoring can flag unusual ones. Pair that with the people side. When clients worried about AI voice scams, we set up MFA through an authenticator app, Login IP Ranges, and training that says: if "IT" calls, hang up and call back on a number you find yourself.

Our take

Your next Salesforce security problem will most likely log in with valid credentials. It will be a former employee, an over-permissioned integration, or an app nobody remembers installing.

MFA is handled. Now check who already has a key.

🔒 Take the free Salesforce Security Audit. It takes minutes and covers access, authentication, connected apps, integrations, data sharing and monitoring, mapped to SOC 2, ISO 27001, HIPAA, GDPR and CCPA.

FAQ

Does Salesforce require MFA in 2026? Yes. Salesforce enforces MFA for all internal users in 2026 and removed the option to exempt users from it. Admins and other privileged users must use phishing-resistant MFA, such as a security key or a built-in authenticator like Face ID.

What is phishing-resistant MFA? It's MFA that only works on the real website. A security key or Face ID checks the site's exact domain, so a fake login page can't capture a working code.

What is a connected app in Salesforce? A connected app lets an outside tool, like a sales engagement or support app, read or write your Salesforce data. Each one has its own access, and it keeps that access until someone removes it.

How often should we review Salesforce security? Review users and admin access every quarter, and connected apps and integrations at least twice a year. Review again before any new integration or AI agent goes live.

Who should own Salesforce security? One named person, with a regular review on the calendar. If your admin is stretched thin, an outside partner like our Managed Services team can run the reviews for you.