Salesforce MFA Enforcement: Guidelines for Provar Users

Salesforce is introducing mandatory Multi-Factor Authentication (MFA) enforcement across all Salesforce orgs.

In addition, Salesforce is enforcing phishing-resistant MFA for privileged users (including System Administrators and users with elevated permissions) starting 22 June 2026 in sandboxes and 1 July 2026 in production environments.

What This Means for Provar Users

If you run automated tests through Provar, these changes may affect how your Salesforce connections authenticate. The impact depends on the connection type you use.

Provar supports Salesforce security requirements and provides multiple authentication options to help ensure your automation continues to run without disruption from MFA enforcement

• OAuth JWT Flow – Headless authentication, MFA is not prompted while creating the connection or during execution. 

Refer to: Adding a Salesforce OAuth JWT Connection

• OAuth Web Flow – MFA is typically prompted during initial connection setup. Once the connection is established, MFA does not interrupt normal test execution unless reauthorization is required.
  Refer to: Adding a Salesforce OAuth Connection

• SSO with MFA (TOTP) –  MFA is prompted at every session depending on your organization’s identity provider and security policies. Requires your MFA to be configured with a TOTP secret key for automatic resolution.

Refer to: Secure Login with MFA/SSO Using Provar

We recommend using the OAuth JWT connection flow in Provar that supports headless authentication and works well for Phishing-resistant MFA as well, however you can choose the option that best fits your team’s security policies and automation requirements. See the sections below for full details on each.

Additional Guidance

Working with Your Salesforce Administrator

Where your organisation uses dedicated automation user accounts, coordinate with your Salesforce administrator to request an MFA exemption for those users. Salesforce may approve MFA exemptions for valid automated testing use cases, but as of June 2026, exemptions must be approved by Salesforce Support rather than set via a profile permission. Your administrator should raise this request with Salesforce Support ahead of your next test cycle.

Organizational Security Policies

Note: The behaviors described in this article reflect standard Salesforce MFA enforcement. They may vary depending on the strictness of your organization’s security policies. If you encounter unexpected MFA prompts after following the steps above, contact your Salesforce administrator to review your org’s session security and MFA policy settings.

---

Feedback

Was this article helpful for you?

We really appreciate it!

Thank you for your feedback.

Tell us how we can improve this article.

No Yes