How to navigate mandatory multi-factor authentication, Enhanced Domains, and the future of external authentication without breaking the user journey.
As the excitement of the latest release cycle starts to settle and the Dreamforce ’25 confetti is cleared away, we’re all moving into that phase of the year where the focus shifts from high-level vision to practical value. By now, you’ve likely filled your Salesforce+ queue with enough content to last through 2026, and you’re starting to ask the real-world questions about what it takes to keep your digital foundations secure.
While headline-grabbing AI features often dominate the conversation, the true “rubber meets the road” moment happens before a user ever sees a dashboard; it happens right at the login screen. We’ve done the homework on the latest identity shifts to help you separate the signal from the noise and ensure your Experience Cloud site remains a trusted space.
TL;DR: To authenticate external users safely in 2026, you must implement Salesforce Single Sign-On (SSO) combined with mandatory MFA and Enhanced Domains to ensure a frictionless, secure user journey.
Why SSO is Non-Negotiable in 2026
In an era of AI-driven security threats, relying on manual passwords is more than an inconvenience; it’s a liability. Credential stuffing attacks have become sophisticated enough to bypass simple password policies with ease.
Modern Identity Management solves two critical problems at once:
- Security: It centralizes credential management, enabling you to enforce strong security policies (such as biometrics or hardware tokens) at the Identity Provider (IdP) level rather than managing thousands of fragmented passwords in Salesforce.
- The “Friction Gap”: Every second spent on a “Forgot Password” flow is a second your partner or customer isn’t engaging with your site. SSO eliminates this hurdle, significantly improving the overall user experience (UX).
Choosing Your Protocol: SAML vs. OIDC
When setting up authentication for external users, you generally choose between two standard paths:
- SAML (Security Assertion Markup Language): The enterprise veteran. SAML uses XML-based assertions to pass identity information. It is the gold standard for B2B scenarios where your partners already use robust providers like Okta, Ping Identity, or Microsoft Azure.
- OpenID Connect (OIDC): Built on top of OAuth 2.0, OIDC uses JSON/JWT. It’s leaner and ideal for consumer-facing sites or professional communities where users log in via social or professional identities like Google, LinkedIn, or Apple. This could require creating and maintaining Custom APEX handlers for OIDC configurations.
My Tip: If you’re building for deep enterprise integration, lean toward SAML. If you’re building for speed and high-volume consumer access, OIDC is your best bet.
The 2026 Mandates: Enhanced Domains, MFA, & Device Activation
The “Identity Landscape” has shifted significantly over the last 12 months. If you haven’t updated your SSO settings recently, you may be seeing a broken flow.
- Enhanced Domains Requirement: Following the final enforcement in late 2025, legacy instance URLs (e.g., na1.salesforce.com) are no longer supported. Your SSO configurations—specifically your Assertion Consumer Service (ACS) URL—must now use your My Domain or site-specific URL. Failure to update these in your IdP will lead to “redirection loop” errors.
- Universal MFA Enforcement: Salesforce now requires Multi-Factor Authentication for all logins. For SSO users, this means your IdP must pass a “claim” (like the amr claim in OIDC) to Salesforce to prove that MFA was completed. If Salesforce doesn’t see proof of MFA in the assertion, it may trigger an additional MFA prompt, defeating the “single” in Single Sign-On.
- Device Activation & Identity Verification: Even with SSO, Salesforce may trigger Device Activation prompts if a user logs in from an unrecognized browser or IP range. In 2026, managing “Trusted IP Ranges” at the Profile or Org level is critical to keeping the login flow frictionless for your frequent users.
Architectural Deep Dive: Solving the Multi-Company Site Puzzle
One of the most common hurdles our developers see is managing a custom experience when a single Experience Cloud site serves users from multiple different companies, each with its own IdP.
Documentation often defaults to your general Salesforce instance, but for a branded experience, you need to use the “Secret Sauce”:
- Swap the URLs: In your Identity Provider settings (Azure/Okta/etc), use your Experience Cloud site-specific login URL instead of the standard Salesforce My Domain URL. This ensures that when the user is authenticated, they are redirected directly to the site rather than to the Salesforce internal UI.
- The Audience Exception: While the login URL changes, the Audience Restriction (Entity ID) should typically remain your Salesforce My Domain URL. This acts as the “technical handshake” that confirms the assertion is meant for your specific Salesforce instance.
If you have multiple IdPs tied to a single Experience Cloud, the login page can become confusing for users, who may see multiple SSO login buttons when they need only one.
My Tip: if multiple customers use different IdPs to access an Experience Cloud site, it is better to use an IdP-initiated login.
Troubleshooting Common SSO Roadblocks
If you’re seeing the dreaded “Single Sign-On Error,” check these three common failure points:
- Certificate Expiration: SSO relies on trust certificates. If your IdP certificate expires, the “handshake” fails. Always set a calendar reminder for 30 days before your certs expire.
- Clock Skew: If the system time on your IdP server differs from Salesforce by more than a few minutes, the assertion will be rejected as “stale.”
- Attribute Mapping: Ensure the “Subject” passed by the IdP (usually an email or Federation ID) exactly matches the Federation ID field on the User record in Salesforce.
My Tip: SAML Assertion Validator is your best friend for troubleshooting.
2026 Best Practices Checklist
| Best Practice | Implementation Action | Primary Audience |
| Audit Your URLs | Confirm your Identity Provider (IdP) is using site-specific URLs and has fully migrated away from legacy *.force.com redirects. | Salesforce Admin / Architect |
| Enable Secure AMR | Ensure your OIDC/SAML tokens include the Authentication Method Reference (AMR) to satisfy Salesforce’s mandatory MFA requirements. | Identity Specialist / Dev |
| Deep Link Testing | Verify “direct-to-record” links to ensure they properly trigger the SSO flow rather than dropping users on a generic login page. | QA / Salesforce Admin |
| Monitor Identity Logs | Regularly audit the Identity Verification History in Salesforce to proactively identify and resolve “blocked” login attempts. | Salesforce Admin |
| SAML Identity Type | Utilizing Federation ID is not environment-specific and is the most commonly used. | Salesforce Admin |
Common Questions We’ve Answered
Why is my Salesforce SSO redirecting users to the internal UI instead of the Experience Cloud site?
This usually occurs when the Identity Provider (IdP) is configured with your standard Salesforce My Domain URL. To fix this, swap the Assertion Consumer Service (ACS) URL in your IdP to your specific Experience Cloud site login URL.
Does Salesforce’s mandatory MFA apply if we already use SSO with our own MFA?
Yes. However, you must ensure that your IdP issues a “proof of MFA” claim (e.g., the amr claim in OIDC) to Salesforce. If Salesforce receives this claim, it recognizes the MFA is complete and won’t prompt the user again.
Will my SSO break when legacy hostnames are officially retired?
Yes, if your configuration still uses instanced URLs (e.g., na123.salesforce.com). You must update your SSO settings to use Enhanced Domains or your My Domain URL to ensure the authentication “handshake” remains valid.
How do I handle multiple companies with different Identity Providers on a single site?
The “secret sauce” is to provide each company’s IdP with your site-specific login URL while keeping the Audience Restriction (Entity ID) as your Salesforce My Domain. This allows multiple partners to use their own credentials to access the same branded site.
Looking to modernize your Experience Cloud security? Contact Digital Mass to talk with our team about SSO, MFA, and the latest in Identity Management.
