We’re starting to evaluate the new ECA authentication option for the ISC Salesforce SaaS connector.
Our organization requires MFA for the Salesforce service account. During Authorize, Salesforce prompts us to register a passkey or use another MFA method.
My concern is that a Windows passkey would be tied to the administrator’s device. If the connector ever needs to be reauthorized, how would another ISC administrator complete the authentication?
How is everyone planning to handle this? Has SailPoint or Salesforce provided any guidance on the recommended MFA approach for the connector service account?
Any guidance or best practices would be really helpful. Thank you.
Did you get any guidance on this from SailPoint or anyone? We are also working on the similar setup and we encountered this. Additionally, I had question on the Service Account being “API Only” user but when we click on ‘Authorize’, it won’t work since it is an API Only user and we had to switch it to regular user first and login and setup the pass key. I was hoping we had more guidance from SailPoint regarding this.
A common approach is not to use a device-bound Windows passkey for a shared Salesforce service account, since reauthorization could become dependent on a specific administrator’s device.
Recommended options:
Use a shared MFA method that can be transferred between administrators, such as:
Salesforce Authenticator managed by the service account owner team.
TOTP authenticator stored in an enterprise password vault (CyberArk, HashiCorp Vault, 1Password, etc.).
Hardware security keys (YubiKey) with multiple registered keys stored under team control.
Register multiple MFA methods on the Salesforce service account so another administrator can reauthorize the connector if needed.
Maintain documented break-glass/recovery procedures for connector reauthorization.
For ECA, the Salesforce account should be treated as a non-personal service account, and MFA ownership should belong to the IAM/admin team rather than an individual administrator’s workstation.
I haven’t seen a SailPoint-specific recommendation favoring Windows passkeys. Most organizations are leaning toward shared hardware keys or vault-managed TOTP to avoid dependency on a single administrator device.
Salesforce External Client App Authentication and Multi-Factor Authentication restrictions. Because Salesforce requires MFA for all direct UI logins using personal device-bound credentials creates a single point of failure if another administrator needs to reauthorize the connector.
Because Salesforce requires MFA for all direct UI logins, using personal device-bound credentials creates a single point of failure if another administrator needs to reauthorize the connector.
you can check this if this helps - Announcement: Salesforce External Client App is now Available