Page Comparison

...

Info

*Salesforce indicates that MFA is not a requirement for API or integration logins:
https://help.salesforce.com/s/articleView?id=000352937&type=1#mfa-affected-list

https://help.salesforce.com/s/articleView?id=sf.mc_overview_mfa_faq_api.htm&type=5

Additionally and separately, we have found that existing connections via third party integration platform and backups are maintained when MFA is enforced and configured through the permission set. This is expected, since the permission applied is “Multi-Factor Authentication for User Interface Logins”.

...

Although there are MFA methods mentioned in user setup, this is not how MFA is enabled. MFA is enabled through a permission set with a specific permission that enforces an MFA method to log in. Users can define an MFA method through their user profile, or can be prompted to set up a method once MFA is enforced.

The following is the simplest one straightforward method to enforce MFA and assumes that a Single Sign On (SSO) method is not implemented (for example, enforced SSO through Office 365).

Go to Setup, and go to “Permission Sets” (search for permission in the quick find box).
At the top of the table of existing permission sets, you will find a “New” button.
Provide a name for the permission set, for example “Multi-Factor Authentication” in the Label field.
1. Label: Multi-Factor Authentication
The API Name will be populated automatically when existing exiting the Label field. Click “Save”.
Go to System Permissions and click the “Edit” button.
Find the permission item for “Multi-Factor Authentication for User Interface Logins” and check the corresponding “Enabled” checkbox. Click “Save”.
On the next page, click on the “Manage Assignments” button, then “Add Assignments”
Select the users who need to be added and click the “Assign” button.
At next login, the users will be prompted to set up a Salesforce Authenticator as the Multi-Factor method (if they have not already specified one on their account).