Some time ago I had to enable the MyDomain Feature in order to enable custom lightning components on a Sandbox-Org as described here. Until that the two factor authentication was working with password and security codes send by email until then - which was the desired and expected situation.

During the activation of MyDomain this method was replaced unasked and unwanted so that now no longer a code is send by email but users are forced to use the Salesforce Authenticator App installed on a mobile device.

We don't want to use this mechanism and the app, because we don't like it at all. Is there any way to completely disable this method and go back to security codes via email?

It looks like this on the desktop:

enter image description here

It seems to offer a way out (Link "Use a different Verification Method" in the bottom)

enter image description here

But neither of the option is what we are looking for

enter image description here

I have tried to find a way to configure it reading the documentation here https://help.salesforce.com/articleView?id=basics_identity.htm&type=0&language=en_US&release=208.8

But I was not able to find a setting to get rid of the Authenticator App again.

  • 1
    Check any permission set is not defined with 2FA enabled. If it is then edit the permission set, or you can remove users from that permission set. Jun 14 '17 at 7:45
  • Thanks @Sagar - So if on one permission set 2FA is not enabled, the Authenticator App is just "jumping in"? And this happens just unasked, unwanted and undocumented? Hard to believe... And why did the Authenticator App starts anoying just during MyDomain activation, while the org was working before with the security codes by email? There were NO CHANGES AT ALL on permission sets nor on profiles? Do you have any link to further documentation on why you are suggesting to check the permission sets? Or is this just your guess?
    – Uwe Heim
    Jun 14 '17 at 9:08
  • This is not a guess, AFAIK there is a way to setup 2FA using permission sets - so just to have check i suggested to check permission sets automationchampion.com/2013/10/17/… Jun 14 '17 at 9:18
  • I assume you checked all session settings? i.imgur.com/f4uWICF.png This does not seem related to mydomain to me but rather a new quirk. there's another known issue aronud identity currently: success.salesforce.com/… Jun 14 '17 at 12:44

I know this post is old, but had to disconnect the app for a user in order to allow her to authenticate without the app so I figured I would reply.

The system administrator can disconnect app from the user profile. On the user profile, find "App Registration: Salesforce Authenticator" and then hit "disconnect".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.