vulkro-sf org mfa
Every live-org command (vulkro-sf org ...) is part of Pro: Live-org audit (sf-live-org), permissions, session, MFA, sharing, packages and trust, read from the org itself. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.
Live MFA enforcement audit (SF-MFA-001 / -002 / -003).
Reads the full active-user roster and reports where the MFA exemption flag is set on the accounts that matter most: integration profiles and administrators.
Synopsis
vulkro-sf org mfa --target-org <alias> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--target-org, -o <alias> | string | (required) | Target org alias or username, as known to sf org login. |
--format <fmt> | table | json | table | Output format. |
--verbose, -v | flag | off | Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins). |
What gets read
The full active-user roster with Profile.PermissionsExemptFromMfa and
FederationIdentifier, plus the set of active LoginFlow records.
What gets reported
| Rule | Severity | What fires |
|---|---|---|
SF-MFA-001 | High | A standard integration profile (SalesforceIQ Integration User, Marketing Cloud, and similar) with Profile.PermissionsExemptFromMfa = true. Signal org-mfa-not-required-on-integration-users. |
SF-MFA-002 | High | A System Administrator with the exemption flag set and no FederationIdentifier. A SAML SSO carve-out suppresses this rule, since MFA is then enforced at the identity provider. Signal org-mfa-not-required-on-admin-users. |
SF-MFA-003 | Medium | An active LoginFlow bound to the System Administrator profile. Often intentional; surfaced for review. Signal org-mfa-loginflow-active-on-standard-profile. |
Examples
vulkro-sf org mfa --target-org my-prod
vulkro-sf org mfa -o my-prod --format json > mfa.json
Exit codes
0- no findings.1- findings reported.2- error.
Scope and honesty
The org is read locally through your own authenticated sf CLI login;
nothing is sent anywhere. The audit reads user and profile metadata,
plus login flows. No business records are read, and no credential or
MFA secret is read.
The rules reason about the org's exemption configuration. They
cannot see whether a given user has actually registered an
authenticator, and they cannot verify what an external identity
provider enforces beyond the presence of a FederationIdentifier.
SF-MFA-003 in particular is informational: a login flow on the admin
profile is frequently deliberate.
A run with no findings means these three rules did not fire. It is not a certification that MFA is correctly enforced across the org.
Where to go next
- vulkro-sf org login-history - the per-profile MFA and IP-allowlist policy audit.
- vulkro-sf org integration-users - the service-account lifecycle audit, which also covers MFA-exempt bots.