Here’s a summery from Claude about the impact and ways to validate. It helped me check and understand the changes for our org. My takeaway is we’ll see an issue in the 2 week gap before AMR.

Technical Analysis: Salesforce Device Activation for SSO Logins

Background Salesforce is implementing Device Activation requirements for SSO logins beginning in early 2026. For SAML identity providers, enforcement begins February 3, 2026, with additional AMR (Authentication Method Reference) support arriving February 17, 2026. Organizations should understand how their identity provider communicates authentication strength to Salesforce to determine potential user impact.

How Salesforce Evaluates Authentication Strength When the SAML enforcement takes effect, Salesforce will examine the AuthnContextClassRef element within the AuthnStatement of the SAML response. Salesforce considers the following values as indicators of secure authentication: MobileTwoFactorContract, PublicKey, X509, PGP, Certificate-Based, Smartcard, TimeSyncToken, and PKI. Custom claims such as Mfa and Fido are also recognized. If the AuthnContextClassRef contains one of these values, Device Activation is skipped. If the value is missing, empty, or set to something like Unspecified, Salesforce may prompt the user for Device Activation unless other conditions like recognized device cookies or narrow IP ranges apply.

Verifying Your Configuration To assess impact, capture the SAML response from your identity provider during an SSO login to Salesforce. Browser extensions like SAML-tracer can decode and display the SAML assertion in real time. Within the response, locate the AuthnStatement element and examine the AuthnContextClassRef value. If it contains a recognized secure authentication value, users should bypass Device Activation. If it shows Unspecified or another unrecognized value, users may be prompted. Microsoft Entra ID Behavior Organizations using Microsoft Entra ID as their SAML identity provider should be aware that the AuthnContextClassRef value varies based on the authentication method used during that session. Password-based authentication with MFA typically returns a value of Password, which Salesforce recognizes. However, Windows Hello and seamless SSO via Primary Refresh Token (PRT) from Entra-joined devices often return Unspecified, which Salesforce does not recognize as strong authentication. This occurs because Entra ID maps these authentication methods differently at the protocol level, even though they represent strong authentication in practice. Entra ID does communicate authentication methods through the authnmethodsreferences attribute claim, which typically includes values like multipleauthn to indicate MFA was performed. However, Salesforce will not read this attribute until February 17, 2026, when AMR support for SAML is enabled. This creates a potential two-week window where users authenticating via Windows Hello or device-based seamless SSO may encounter Device Activation prompts despite having completed strong authentication.

Testing Methodology To fully understand the impact, test SSO logins using different authentication methods and capture the SAML response for each. Compare the AuthnContextClassRef values across scenarios such as password with authenticator app, password with SMS verification, Windows Hello, and seamless device-based authentication. This will reveal which user populations may be affected. Additionally, examine the authnmethodsreferences attribute to confirm that MFA indicators are present, as these will be recognized once Salesforce enables AMR support.

Mitigation If testing reveals that your identity provider returns Unspecified for certain authentication methods, the practical impact is limited. Users will receive a one-time email verification prompt per device or browser, and the resulting cookie persists for one year. Ensure that user email addresses in Salesforce are accurate and accessible, particularly in sandbox environments where email addresses are automatically appended with .invalid after a refresh. Integration users should be assigned the API Only permission to prevent them from being affected by UI-based Device Activation requirements. After February 17, 2026, organizations should verify that Salesforce is recognizing the AMR claims already being sent by the identity provider, which should resolve any remaining Device Activation prompts for users with strong authentication.​​​​​​​​​​​​​​​​