Posting a Q&A on how to use MFA for shared accounts that "perhaps" violates SFDC TOS

Question

I'm ambivalent about this one and seek guidance:

Let's say you have some service account user seats in your org and multiple people need to occasionally login to these. Let's further say that Login As is not available. With MFA, how do you have multiple people be able to login to that account given that MFA is tied to a device?

Now, per the SFDC MFA FAQ

Some of our users share a single Salesforce account. How can we implement MFA?

Salesforce prohibits sharing user credentials with multiple users. Before you can satisfy the MFA requirement, you need to resolve any shared accounts or credentials that are in use. This practice is incompatible with MFA because each user must register and connect a unique verification method to their Salesforce account before they can log in. If multiple users are sharing a single account, only one person will be able to log in to that account after MFA is enabled.

Now there is a solution for this (discovered in the SFDC MFA Community) that I have proven to work and I'm tempted to post the Q&A for this in StackExchange.

Since the solution should apply to service accounts (like say, the user seat assigned to case automation, data migration, designated platform event context user, etc) it doesn't seem like this violates the spirit of the 1 person - 1 SFDC user Terms of Service (after all, these service accounts are consuming SFDC seats at incremental cost).

But the same solution could be hijacked by multiple real humans sharing a single SFDC user seat.

Hence my ambivalence.

Of course, information wants to be free

Answer 1

A Service User, by definition, is a MSA violation. After all, that user is connected to another service that almost certainly has more than one user. Even Salesforce has a Service User concept across orgs, the Salesforce-to-Salesforce feature. If you just read the MSA, S2S seems like it must be a violation, and yet it is something we were given. Also, I haven't worked for any decently-sized org that doesn't have at least one Service User that would be in violation of the MSA. They are incredibly useful for their purpose.

Salesforce.com isn't worried about the "occasional" extra access on a user. The MSA is meant to provide a way to recover commensurate compensation for organizations that are willfully trying to minimize their contract costs by having too many people use too few user accounts on a regular basis. The occasional excursion you've described is a violation of the letter of the MSA, but not the spirit of the MSA. If I saw your question, and decided to answer, I would make every possible attempt to provide the best solution, but with a disclaimer that it should only be used for legitimate purposes, because the MSA is very clear on the potential consequences.

Also, in general, I agree that information wants to be free. Knowledge is a tool, and as such, can be used for good and bad. The understanding of nuclear physics gave us the hydrogen bomb, nuclear reactors, life-saving cancer treatments, and even smoke detectors. All of these inventions, and more, were inevitable once we found out what radioactivity was. Being able to have multiple users log in to a single user account, for specific purposes, is a useful feature, but also not without risks.

At minimum, I would agree with the various comments on your question. You should definitely ask it. The worst-case scenario is that it will be closed/deleted, and that's about it. Anyone who uses the information provided in an attempt to willfully violate the spirit of the MSA will typically be found out and punished harshly. Salesforce.com doesn't post how regularly this happens, as far as I can tell, but I'm pretty sure sanctions are few. The potential benefits appear to outweigh the actual risks here.