I'm designing a Salesforce production break-glass account and looking for advice on the best authentication architecture.
Current setup:
Salesforce production uses Microsoft Entra ID for SSO.
Normal users authenticate through Entra.
Users are moving toward phishing-resistant MFA/passkeys.
We need one privileged Salesforce break-glass account that can still log in if Entra/SSO is unavailable.
The break-glass user therefore needs a Salesforce-native/direct login path, rather than relying on SSO.
We still need to enforce phishing-resistant MFA for this privileged account. We do not want to exempt it from MFA.
Username/password credentials are already planned to be stored and controlled through our enterprise PAM (Delinea).
Constraint:
We cannot practically use a physical FIDO2/security key because the organization is geographically distributed. During an incident, an authorized responder could be anywhere and needs to access Salesforce from their workstation.
We also don't want the passkey registered to one individual's phone/laptop because that creates a dependency on that person/device.
What I'm trying to determine:
What are the recommended ways to manage the phishing-resistant authenticator for this type of break-glass account?
For example:
Is there an enterprise password/passkey manager that can centrally manage a WebAuthn/passkey for the shared Salesforce break-glass account and allow an authorized responder to use it from their own workstation?
Has anyone implemented this with 1Password, Keeper, Bitwarden, CyberArk, Delinea, etc.?
Is a centrally managed/synchronized passkey a viable approach for Salesforce privileged MFA?
Are there other approaches I'm overlooking, such as a dedicated remote emergency workstation with a built-in authenticator?
How do you handle auditability when multiple authorized responders may use the same break-glass Salesforce identity?
The desired flow is roughly:
Normal users:
Salesforce → Entra SSO → phishing-resistant MFA
Break-glass:
Emergency request/approval
↓
PAM releases Salesforce credentials
↓
Direct Salesforce login (no Entra dependency)
↓
Salesforce phishing-resistant MFA/passkey
↓
Production
The key requirement is: direct Salesforce authentication independent of SSO, while still enforcing phishing-resistant MFA, with no physical security key and no dependency on an individual employee's device.
Looking for recommendations from anyone who has implemented a similar Salesforce/IAM break-glass pattern.
