Fix: Salesforce “MFA” Enrollment Loop on Mobile Devices

A Salesforce Multi-Factor Authentication (MFA) enrollment loop occurs on mobile devices when the login process continuously bounces a user between the Salesforce mobile app, their mobile web browser, and an authenticator app without completing authentication. The user inputs their credentials, gets redirected to enroll or verify an authenticator, confirms the prompt, and is immediately returned to the login screen to start over. This loop is typically caused by in-app browser cookie blocking, broken mobile operating system deep links, stale verification pairing, or mobile session policy conflicts.

Fast Fix

Disconnect the user’s existing authenticator registration in Salesforce Setup (Users > [User] > App Registration: One-Time Password Authenticator > Disconnect). On the mobile device, set the default web browser (Safari or Chrome) to allow cross-website tracking and cookies temporarily. Then, prompt the user to log in and re-enroll from scratch.

---

Diagnostic Snapshot

• Error Behavior: Infinite redirection between Salesforce mobile app, browser WebView, and Salesforce Authenticator / third-party TOTP apps.
• Primary Scope: Salesforce Mobile App (iOS and Android), Salesforce Authenticator, Microsoft Authenticator, Google Authenticator.
• Core Mechanism: Lost session state during app-switching handshakes or blocked OAuth callback tokens.
• Access Needed: System Administrator access to reset user MFA factors and review Session Settings.

---

What Causes the Mobile MFA Loop

When a user logs into Salesforce on a mobile device, the authentication sequence relies on external app handshakes:

1. The Salesforce mobile app opens an embedded browser (WebKit WebView on iOS or Chrome Custom Tabs on Android).
2. The user enters credentials and is directed to verify identity.
3. The platform generates an authentication challenge and switches focus to an authenticator app using an OS-level deep link (Universal Link or App Link).
4. The user approves the request.
5. The authenticator app hands an authorization code back to the mobile browser via another deep link.
6. The browser exchanges that code for a secure session token and hands it back to the native Salesforce app.

If your device blocks cookies in WebViews, if the default browser changes between steps, or if the operating system fails to pass the deep link back to the native app, the handoff drops. Salesforce sees an unauthenticated request and reloads the initial login page.

---

Diagnostic Path

MFA Loop on Mobile Device
 ├── Is the user prompted to register MFA repeatedly?
 │    ├── Yes ──► Admin must disconnect stale MFA registrations on the User record
 │    └── No (Stuck on approval screen)
 ├── Does the loop occur when switching apps?
 │    ├── Check mobile browser settings: Disable "Prevent Cross-Site Tracking" (iOS)
 │    └── Check default browser: Must match between app launch and redirect
 └── Is an MDM (Intune, Workspace ONE) managing the device?
      └── Verify App Protection Policies permit deep linking between Salesforce and Authenticator

---

Resolution Steps

1. Clear Stale MFA Registrations in Salesforce Setup

If a user previously attempted to connect an authenticator app and the registration was interrupted, Salesforce flags the factor as partially provisioned.

1. As an Administrator, go to Setup > enter Users in the Quick Find box.
2. Select the affected user.
3. Scroll down to the fields under User Detail:
   • App Registration: Salesforce Authenticator
   • App Registration: One-Time Password Authenticator
4. Click Disconnect next to any active or pending registration.
5. Have the user force-close all Salesforce and Authenticator apps on their phone, open the Salesforce app, and complete the enrollment prompt cleanly. If push notifications fail during enrollment, see How to Resolve: Salesforce Authenticator “Push Notification Not Received”.

2. Adjust Mobile Browser Privacy and Cookie Settings

Mobile operating systems increasingly restrict how cookies and sessions persist across embedded browser tabs.

• On iOS (iPhone/iPad):
  1. Go to Settings > Safari (or your default browser).
  2. Under Privacy & Security, temporarily toggle off Prevent Cross-Site Tracking.
  3. Ensure Block All Cookies is turned off.
  4. Ensure your default browser is set to Safari or Chrome consistently.
• On Android:
  1. Open the Chrome app > tap the three dots > Settings.
  2. Tap Site settings > Cookies.
  3. Select Allow cookies (or toggle off “Block third-party cookies in incognito”).

3. Resolve Mobile Device Management (MDM/MAM) Data Transfer Blocks

In corporate environments using Microsoft Intune, VMware Workspace ONE, or MobileIron, security containers often prevent managed apps from sharing data with unmanaged apps.

• If the Salesforce app is managed by Intune but the Authenticator app is not, the operating system blocks the OAuth redirect token from returning to the Salesforce container.
• The Fix: Ensure both Salesforce and the authenticator app reside within the same managed work profile, or configure Intune Data Transfer policies to allow open communication between the specific app bundle IDs. If updates to the mobile container cause wider instability, see Troubleshooting: Salesforce “Mobile App” Crashing on iOS 19/Android 16.

4. Verify High Assurance Session Settings in Setup

If your org requires a High Assurance session upon login, an incorrect session configuration can trigger a recursive loop:

1. Navigate to Setup > Identity > Session Settings.
2. Scroll to Session Security Levels.
3. Confirm that Multi-Factor Authentication is in the High Assurance column.
4. Check your user profiles (Setup > Profiles > [Profile Name] > Session Settings). If Session Security Level Required at Login is set to “High Assurance” while the login flow policy does not natively recognize the mobile handshake, set it to None and enforce MFA via Permission Sets instead.

---

Common Misdiagnoses

• SSO Identity Provider Conflict: If your organization uses an external Identity Provider (such as Okta, Azure AD, or Ping) and enforces Salesforce-level MFA simultaneously, users enter a double-challenge loop. If your IdP already requires MFA, ensure the Salesforce setting “Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org” does not inadvertently target SSO users. If SSO loops occur, review Fix: Salesforce “You do not have the required permissions” (Identity Loop).

---

Hard Stops

• Never disable organization-wide MFA to bypass an individual device issue. Contractual agreements and platform compliance rules mandate MFA. Reset the individual user’s credentials or provision a hardware security key (such as a YubiKey) instead of turning off security policies globally.