Microsoft Entra ID

Salesforce Sandbox Tutorial

25 July 2026Updated+3 / −6 lines

In brief

* Manage your accounts in one central location.

Documentation change

Manage your accounts in one central location.

Note

We are aware that Salesforce will enforce the device activation changes for Single Sign-On (SSO) Logins starting February 3, 2026. We have worked closely with the Salesforce team, and beginning February 3, Salesforce will start accepting the authnmethodreferences claim included by default in the SAML token issued by Entra ID. If the authnmethodreferences claim contains the value multipleauthn, Salesforce will treat the device as trusted. Please ensure that your Conditional Access policy which will enforce MFA is configured to satisfy this requirement. You can read more about this claim here.

Updated: July 24, 2026 - Starting June 29, 2026, Microsoft Entra ID will automatically include Authentication Method References (amr) and Authentication Context References (acr) claims in tokens issued for SAML 2.0 and OpenID Connect (OIDC) applications using the Microsoft identity platform v2.0 endpoint. If you have configured External MFA Provider with Entra ID and if that provider is sending AMR signals then Entra ID will forward that AMR signal to Salesforce or other 3P applications as needed. These claims provide additional information about how the user authenticated and the authentication context satisfied during sign-in. No configuration changes are required in Microsoft Entra ID for Salesforce Sandbox single sign-on. To help satisfy Salesforce phishing-resistant MFA requirements for Salesforce admins, customers should apply Microsoft Entra Conditional Access policies that require phishing-resistant authentication methods for Salesforce administrator sign-ins.

For customers using OpenID Connect Authentication with Salesforce or if you have configured Salesforce with custom OpenID Connect provider, you can switch back to the Microsoft identity platform v2.0 endpoint. The v2.0 endpoint now sends the amr claim in the token as needed by Salesforce based on the user's authentication.

For customers using AD FS as the federation provider with Entra ID, please follow the MFA expected inbound assertions guidance for SAML 2.0 federated IdPs so that Entra ID will have this claim in the SAML token.

For customers using AD FS as the federation provider with Entra ID, please follow the guidance published here so that Entra ID will have this claim in the SAML token.

If you are using any other federation provider then we are still working on standardizing the AMR and ACR signals first and will provide the update soon.

Prerequisites

The scenario outlined in this article assumes that you already have the following prerequisites:

diff --git a/docs/identity/saas-apps/salesforce-sandbox-tutorial.md b/docs/identity/saas-apps/salesforce-sandbox-tutorial.md
index e3057c837bd..ff2678d7b86 100644
--- a/docs/identity/saas-apps/salesforce-sandbox-tutorial.md
+++ b/docs/identity/saas-apps/salesforce-sandbox-tutorial.md
@@ -16,14 +16,11 @@ In this article,  you learn how to integrate Salesforce Sandbox with Microsoft E
 * Manage your accounts in one central location.
 
 > [!Note]
-> **Updated: June 24, 2026** - Starting June 29, 2026, Microsoft Entra ID will automatically include Authentication Method References (`amr`) and Authentication Context References (`acr`) claims in tokens issued for SAML 2.0 and OpenID Connect (OIDC) applications using the Microsoft identity platform v2.0 endpoint. These claims provide additional information about how the user authenticated and the authentication context satisfied during sign-in. No configuration changes are required in Microsoft Entra ID for Salesforce Sandbox single sign-on. To help satisfy Salesforce [phishing-resistant MFA requirements](https://help.salesforce.com/s/articleView?id=005321563&type=1) for Salesforce admins, customers should apply Microsoft Entra Conditional Access policies that require phishing-resistant authentication methods for Salesforce administrator sign-ins. 
-
-> [!Note]
->   We are aware that Salesforce will enforce the [device activation changes for Single Sign-On (SSO) Logins](https://help.salesforce.com/s/articleView?id=005237070&type=1) starting **February 3, 2026**. We have worked closely with the Salesforce team, and beginning February 3, Salesforce will start accepting the **authnmethodreferences** claim included by default in the SAML token issued by Entra ID. If the **authnmethodreferences** claim contains the value **multipleauthn**, Salesforce will treat the device as trusted. Please ensure that your Conditional Access policy which will enforce MFA is configured to satisfy this requirement. You can read more about this claim [here](~/identity-platform/single-sign-on-saml-protocol.md#authnmethodreferences).
+> **Updated: July 24, 2026** - Starting June 29, 2026, Microsoft Entra ID will automatically include Authentication Method References (`amr`) and Authentication Context References (`acr`) claims in tokens issued for SAML 2.0 and OpenID Connect (OIDC) applications using the Microsoft identity platform v2.0 endpoint. **If you have configured External MFA Provider with Entra ID and if that provider is sending AMR signals then Entra ID will forward that AMR signal to Salesforce or other 3P applications as needed.** These claims provide additional information about how the user authenticated and the authentication context satisfied during sign-in. No configuration changes are required in Microsoft Entra ID for Salesforce Sandbox single sign-on. To help satisfy Salesforce [phishing-resistant MFA requirements](https://help.salesforce.com/s/articleView?id=005321563&type=1) for Salesforce admins, customers should apply Microsoft Entra Conditional Access policies that require phishing-resistant authentication methods for Salesforce administrator sign-ins.
 >
->   For customers using [OpenID Connect Authentication with Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_microsoft_only.htm&type=5) or if you have configured Salesforce with [custom OpenID Connect provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_plugin_custom.htm&type=5), you can switch back to the Microsoft identity platform v2.0 endpoint. The v2.0 endpoint now sends the `amr` claim in the token as needed by Salesforce based on the user's authentication.
+> For customers using AD FS as the federation provider with Entra ID, please follow the [MFA expected inbound assertions guidance for SAML 2.0 federated IdPs](~/identity/authentication/how-to-mfa-expected-inbound-assertions.md#using-saml-20-federated-idp) so that Entra ID will have this claim in the SAML token.
 >
->  For customers using AD FS as the federation provider with Entra ID, please follow the guidance published [here](~/identity/authentication/how-to-mfa-expected-inbound-assertions.md#using-saml-20-federated-idp) so that Entra ID will have this claim in the SAML token.
+> If you are using any other federation provider then we are still working on standardizing the AMR and ACR signals first and will provide the update soon.
 
 ## Prerequisites
 The scenario outlined in this article assumes that you already have the following prerequisites: