There are cases when an Admin may need to reset the Multi-Factor Authentication (MFA) method for their users. This may be necessary for a few reasons. A user may have gotten a new phone so they are unable to authenticate with the Authenticator app on their new phone because Salesforce is still connected to their previous phone. Or the MFA is unable to authenticate through their current authentication method.
If either of these happens, a user is unable to authenticate through their current authentification method and then unable to log in.
Below will explain how to disconnect the User's authentication method and send a Temporary Verification Code to the user so that they can log in temporarily until the issue is resolved.
How to Disconnect a User's Authentication Method
1. Navigate to Setup via the gear icon.
2. In the Quick Find box, search for Users.
3. Click on the user's name that needs to have the MFA reset.
4. In the User Detail section the user will either have a One-Tim Password authenticator or the Salesforce Authenticator registered.
Note: One-Time Password Authenticator will be connected if the user is using an authenticator other than Salesforce Authenticator.
5. Click on the [Disconnect] button.
Once this has been disconnected. The next time this user logs in it will prompt the user to sign up and sign in with Authenticator.
Send a Temporary Verification Code
If a User is unable to use the authentication method that is connected for Multi-Factor Authentication, an Admin can generate a Temporary Verification Code. This would be most useful when a User is unable to access the verification method that they typically use to authenticate. The Temporary Verification Code is limited in that it is only valid for 1 to 24 hours and the verification code may be used as many times as needed until it expires.
1. Navigate to Setup via the gear icon.
2. In the Quick Find box, search for Users.
3. Click on the user's name that needs a Temporary Verification Code to be generated.
4. Click on [Generate] next to Temporary Verification Code (Expires in 1 to 24 hours).
5. This will take you to a page where you will choose how long you want the Temporary Verification Code to be available before it expires. Click Generate Code to generate the code for the User.
6. After it is generated, a new page will be visible with the Username of the User who the code was generated for, the Temporary Code, and when it expires (Date & Time).
NOTE: The User will not receive the code via email so you need to share the code with them directly.
7. As long as the Temporary Verification Code is not expired, the User will be prompted with the following when they try to log in instead of the authentication prompt that they normally receive. On this screen, they will enter the verification code that was generated.
8. The User can also view when the Temporary Verification Code will expire by clicking their Avatar in the top right-hand corner of the page once they’re logged into Salesforce and clicking on Settings.
9. Next, click on Advanced User Details on the left-hand side.
10. This will show a User Detail page that is very similar to the one that you see when you click on their User in Setup. Next to Temporary Verification Code (Expires in 1 to 24 Hours), they will see the Date and Time that the code will expire. If they are able to use their Authentication Method again, they can also click [Expire Now], which will cause their Verification Code to expire then rather than the set date and time.
11. If you need to have their Temporary Verification Code expire early, you can also click [Expire Now] in the same place that you initially generated the Temporary Verification Code on their User Detail page in Setup.
