Skip to main content

vulkro-sf org mfa

Live MFA enforcement audit (SF-MFA-001 / -002 / -003).

Reads the full active-user roster and reports where the MFA exemption flag is set on the accounts that matter most: integration profiles and administrators.

Synopsis

vulkro-sf org mfa --target-org <alias> [flags]

Flags

FlagTypeDefaultDescription
--target-org, -o <alias>string(required)Target org alias or username, as known to sf org login.
--format <fmt>table | jsontableOutput format.
--verbose, -vflagoffBump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins).

What gets read

The full active-user roster with Profile.PermissionsExemptFromMfa and FederationIdentifier, plus the set of active LoginFlow records.

What gets reported

RuleSeverityWhat fires
SF-MFA-001HighA standard integration profile (SalesforceIQ Integration User, Marketing Cloud, and similar) with Profile.PermissionsExemptFromMfa = true. Signal org-mfa-not-required-on-integration-users.
SF-MFA-002HighA System Administrator with the exemption flag set and no FederationIdentifier. A SAML SSO carve-out suppresses this rule, since MFA is then enforced at the identity provider. Signal org-mfa-not-required-on-admin-users.
SF-MFA-003MediumAn active LoginFlow bound to the System Administrator profile. Often intentional; surfaced for review. Signal org-mfa-loginflow-active-on-standard-profile.

Examples

vulkro-sf org mfa --target-org my-prod

vulkro-sf org mfa -o my-prod --format json > mfa.json

Exit codes

  • 0 - no findings.
  • 1 - findings reported.
  • 2 - error.

Scope and honesty

The org is read locally through your own authenticated sf CLI login; nothing is sent anywhere. The audit reads user and profile metadata, plus login flows. No business records are read, and no credential or MFA secret is read.

The rules reason about the org's exemption configuration. They cannot see whether a given user has actually registered an authenticator, and they cannot verify what an external identity provider enforces beyond the presence of a FederationIdentifier. SF-MFA-003 in particular is informational: a login flow on the admin profile is frequently deliberate.

A run with no findings means these three rules did not fire. It is not a certification that MFA is correctly enforced across the org.

Where to go next