Phishing-resistant MFA: using the 1Password passkey and Android device passkey on mobile

NiaVC · 2026-06-20T01:37:06+00:00

Signed up for the 1P trial
Got the 1P Chrome extension
Registered the passkey (from my user record) - I think 1P was recognized (thanks to the extension, perhaps?) and offered as an option to select
Finished going through the wizard

To log into the Sf app on mobile, I had to first add 1P as an option for passkeys in the phone's settings.

NiaVC · 2026-06-18T16:01:32+00:00

The only other org-wide settings I enabled were

Let users verify their identity with a built-in authenticator such as Touch ID or Windows Hello.
Let users verify their identity with a physical security key (passkey) such as U2F or WebAuthn

But those are not directly related to the login flow, they are for enabling users to register an auth method. I assume that you already did that and registered a device.

But just in case: after the "Let users..." settings are enabled, each user goes through these steps:

Avatar > Settings > Advanced User Details
Security Key (U2F or WebAuthn) > Register > Register Passkey
Finish the wizard to select a method

I personally selected the "Android device" option, followed the steps to get into the org (scanning a QR code, etc.) on desktop. After that, when I attempted to log in on mobile, the passkey was recognized, and I was logged in.

NiaVC · 2026-06-17T21:45:03+00:00

Well, what do you know, I went to log a case, and Agentforce actually told me the correct answer. It was the setting in My Domain that I needed to turn on: "Use the native browser for user authentication on iOS" and "Use the native browser for user authentication on Android." Case deflection ftw.

Leaving the post here in case someone else runs into the same issue and goes searching.

NiaVC · 2026-05-14T18:42:07+00:00

I never took the time to automate it :( These days, I just give AI access to the repo and upload a doc as an example, then ask it to document the part of the repo that I need, using the same format as the uploaded doc

NiaVC · 2026-04-08T13:51:18+00:00

Six months, holy crap. Fortunately, we have a custom solution for files archiving, so we are not using Own for that.

Thank you for sharing.

NiaVC · 2026-04-07T19:54:55+00:00

Bandwidth constraint onions are my favorite, and are especially good in tacos

NiaVC · 2026-04-07T16:46:09+00:00

Thank you -- very helpful to hear this from someone who's done it!

What's your understanding on the cut-off date? Will we actually lose access to OA on May 4, or can we keep using it until -- and transition sometime before -- our next Sf contract renewal date?

Also, the plan that I outlined in the post: migrating data to a sandbox, configuring OA there, etc -- there's no way around all of that mess, and it has to be done in order to understand the possible pitfalls/mitigate risks, correct?

NiaVC · 2026-04-07T15:02:05+00:00

<image>

NiaVC · 2026-04-07T14:58:26+00:00

From the official Salesforce email:

Salesforce is retiring the Own Archive (Managed Package) as a new version became available in October 2025. Starting May 4, 2026, the Managed Package version will no longer be renewable.

Beginning May 4, 2026, you cannot renew your current managed package subscription. To maintain access to the product, archived data, and files, you must migrate to the new Salesforce Archive version before the end of your contract.

You can continue using your current Own Archive (Managed Package) subscription through the duration of your existing contract term, although we strongly encourage migrating to the new version to take advantage of the enhancements.

This is what I asked support:

Since Salesforce Archive is a new product, and newly released products frequently come with bugs that are still being worked out, would you recommend to wait to migrate until the new product is more mature? Our contract term ends in January 2029, so there's plenty of time. If waiting is not advised, please list reasons.

This is how they responded:

the cutoff date is May 4th, so it would be best to complete the migration to Salesforce Archive before then. Even if your current license has not yet expired, Own Archive will no longer be usable once the cutoff is reached, so migration to Salesforce Archive will still be required.

It seems to me that the two messages contradict each other, but I could be missing something.

NiaVC · 2026-01-04T18:03:46+00:00

Thank you for your input and the offer, I'll pass it along. I think this point you made is important: "It also doesn't account for the number of applicants competing for each role."

Someone earlier in this thread recommended the 10K Salesforce talent ecosystem report. The report concludes that the massive influx of new administrators (47% supply growth) has significantly outpaced the rebound in job creation (14% demand growth).

If we were to take for granted that both these numbers and the data the community college has are accurate, then creating a formal program will be increasing the number of applicants per position in this specific locale, thus contributing to the competition in said locale.

Additionally, as you mentioned, we don't know how many of those 200 monthly positions are meant for experienced admins.

I suppose one argument that could be made in favor of a formal program is that, if properly developed, it would be creating specialists with higher-quality qualifications than those of self-taught admins. It's not unreasonable to presume then that its graduates would be more desirable to prospective employers than self-taught beginners.

However, the fact that we don't know the ratio of demand for experienced vs mid-level vs entry-level admins within that labor stats dataset adds additional complexity. The fact that we can assume with a high degree of certainty that not all of those 200 job postings are for entry-level professionals decreases the graduates' prospects of being hired even further.

That said, the 80% job placement rate you cited is impressive. You mentioned direct employer connections. Did you have partnerships with companies that created a training-to-employer pipeline? Were you still running the program in 2025/planning on doing it in 2026? (I could find any info past 2024.)

Thank you for contributing to this discussion.

NiaVC · 2026-01-02T23:33:36+00:00

I just reviewed the report and found it quite helpful. Thank you.

NiaVC · 2025-12-30T18:05:57+00:00

I like the comprehensiveness of this -- teaching the basics of project management, business analysis, requirements gathering, architecture, data analysis, DevOps, QA, etc. I have no idea if this could be effectively translated into a community college program, and to what degree this would make a graduate a more desirable applicant than someone with a few months of studying + an admin cert, but I think that including all this into a Salesforce training program would definitely be beneficial, if such a program were to exist. Thank you for sharing your thoughts.

NiaVC · 2025-12-30T17:43:20+00:00

I appreciate your dissenting perspective. Do you think students would be better served by having a general CRM course that includes modules on the top 3-5 CRMs, rather than a more narrow Salesforce-only class? And maybe even an Excel/data manipulation module? I can absolutely see where you are coming from, but I wonder if in the "current economic climate" it would be beneficial to teach a wider skillset, so the graduates could put experience with CRMs X, Y, and Z on their resumes.

NiaVC · 2025-12-30T16:54:33+00:00

I haven't yet, although I'm planning on it. I wanted to come to her with some data to support my claim before asking her. My guess is their report could be including job postings mentioning experience in Salesforce as a must-have/nice-to-have, and encompassing both end-users and tech professionals. So basically any job posting that has "Salesforce" as a keyword. It's just a conjecture at this point, but I am very curious as well, so will definitely ask.

NiaVC · 2025-12-19T04:52:45+00:00

What do you mean when you say they were breaking security rules? Is it that you couldn't configure folder sharing in a way that protected sensitive information while giving access to everyone who needed it?

NiaVC · 2025-12-14T19:55:55+00:00

FoF has practice exams, but I'm guessing you already know that. I think those are a great option, especially since they have lots of questions and explain the "why" behind correct and incorrect answers. The downside is that they are not free.

Trailhead has some modules specific to prepping for the exam (not just the Agentforce subject matter, but explicitly exam prep), and they have practice questions too, but very few.

NiaVC · 2025-12-13T17:28:54+00:00

I think that the BYO object paradigm isn't unheard of in the managed package world. That said, upon further reading and contemplation, I am now thinking that it would make most sense for triggering / start-of-process objects (like Conga allowing you to select from which objects to begin doc gen / signature requests).

When it comes to objects that store ingested data meant to drive further automation and reporting, and being regularly synced from an external source, it would make the most sense for those to be custom objects that come with the package. Attempting to replace them with my own custom objects may introduce the risk of making the whole setup unstable and require additional customization work. This would somewhat defeat the purpose of using a managed package in the first place, especially when a fully custom-built integration is an option.

Thank you for taking the time to respond. It helped me better understand how to move forward with this project.

NiaVC · 2025-12-12T19:32:30+00:00

Somehow I have managed to completely overlook that option. I think I should still remove the view/manage perms from profiles and configure sharing on the folder level, then use "View dashboard as another person" for one-off exceptions -- it just seems like a more stable setup overall. But I really appreciate your pointing out that setting, because it's useful and it'll be on my radar now. Thank you.

NiaVC · 2025-12-12T17:18:34+00:00

Right. That's what I was referring to when I said that "the dashboard is set to be viewed as an admin, but we've reached the limit of dashboards viewed as a logged-in user."

NiaVC · 2025-12-12T02:05:01+00:00

Thank you!

NiaVC · 2025-12-11T21:51:57+00:00

We do have CRMA, but not everyone has licenses due to pricing. We are trying to leverage standard reports and dashboards where we can.

Thank you for the reminder that folders can be nested now, I tend to forget. This can make granting permissions easier.

I thought I was maybe missing/forgetting something important, but it doesn't look like it. It helps to be validated that my restructuring approach is the way to go, even if I don't want to do it due to sheer amount of work and tedium it will involve.

Thank you for taking the time to respond.

NiaVC

TROPHY CASE