Unable to Remove or Replace Passkeys in Salesforce? Here’s the Fix
You open a user’s Advanced User Details page to reset their security key, and the Register and Remove links just aren’t there. In almost every case, the cause is two unchecked boxes in Identity Verification.
This comes up a lot when teams roll out MFA, move users to passkeys, or need to help someone who lost or replaced their YubiKey or laptop. Here’s what you’re seeing, why it happens and how to fix it in a couple of minutes.
What the problem looks like
On the user record, the Security Key (U2F or WebAuthn) and Built-In Authenticator rows are missing or have no actions next to them. After the fix, the links show up and you can manage the key.
Why it happens
Salesforce only shows passkey controls when passkeys are allowed as a verification method for the org. If those methods are switched off in Identity Verification, the page hides the related actions, even when a user already has a key registered. So it looks like a bug, but it’s really a setting.
How to fix it
-
Go to Setup and open Identity Verification:Setup›Security Controls›Identity VerificationYou can also type “Identity Verification” in the Quick Find box.
-
Turn on both passkey options:
- Let users verify their identity with a built-in authenticator (passkey) such as Touch ID or Windows Hello
- Let users verify their identity with a physical security key (passkey) such as U2F or WebAuthn
- Click Save.
- Open the user’s record, then go to Advanced User Details (from the user detail page, or via Settings › Personal › Advanced User Details for your own account). Refresh if the page was already open.
- Use Remove to clear the old key. To replace it, remove the old key first, then have the user click Register and follow the browser prompt with their new key or device.
Only need one type? If your org uses physical keys only, you can enable just the U2F/WebAuthn option. The built-in authenticator setting controls Touch ID, Face ID and Windows Hello.
Still not seeing the options?
If both settings are on and the links still don’t show, check these:
| What to check | Why it matters |
|---|---|
| Your own permissions | Removing another user’s verification methods needs admin-level user management permissions, such as Manage Multi-Factor Authentication in User Interface. Without them, you may only see your own controls. |
| Stale page | Settings changes don’t refresh an open record. Reload Advanced User Details after saving. |
| Wrong page | The key controls live on Advanced User Details, not the standard user record in Lightning. Switch to the advanced view. |
| Browser support | Registering a key needs a browser that supports WebAuthn. Older browsers or locked-down corporate browsers can block the prompt. |
| SSO users | If users log in through an identity provider like Okta or Azure AD, MFA usually happens there, so Salesforce passkey settings may not apply to them. |
Common questions
Can users remove their own security key?
Yes. Once the settings are on, users can go to Settings › Personal › Advanced User Details and manage their own key, as long as your org allows it.
Does removing a key lock the user out?
It can, if the key was their only verification method. Make sure they have another method ready, like Salesforce Authenticator or a new key, before you remove the old one.
Can I replace a key in one step?
No. Salesforce treats it as two actions: remove the old key, then register the new one. The user has to register the new key themselves, since it needs their physical device or fingerprint.
Is this related to Salesforce’s MFA requirement?
Yes. Passkeys are one of the strong verification methods that satisfy Salesforce’s MFA requirement for direct logins, which is why more orgs are running into this setting as they roll them out.
Rolling out MFA or passkeys across your org?
We help teams set up identity verification, SSO and user access without locking anyone out.