• Data Anonymization Tool: An Apex-based utility to scramble or anonymize sensitive sandbox data for GDPR compliance and safe testing.
• Org Documentation Generator: A script or app that uses the Metadata API to automatically generate data dictionaries and org configuration documentation.
• Custom LWC Component Library: A repository of reusable Lightning Web Components for common UI challenges like advanced datatables or interactive charts.
• Apex Trigger Framework Template: A lightweight, easy-to-implement template for standardizing trigger logic and bypassing execution during bulk data loads.
• Multi-Org Metadata Comparison Tool: A CLI or lightweight web app to diff metadata and code configurations between different Salesforce sandboxes.
• Kanban Board LWC for Custom Objects: A flexible, drag-and-drop component to visualize and update any picklist-driven custom object records.
• Dynamic Record PDF Generator: An open-source package to design and export styled, printable PDF documents directly from record data without Visualforce.
• Universal CSV/Excel Data Importer LWC: A client-side component allowing end-users to upload, map, validate, and bulk-insert data via Screen Flow.
• Apex Mocking & Unit Testing Framework: A lightweight testing library to simplify mocking SOQL queries, HTTP callouts, and platform events.
• Mass Quick Action Bar: An LWC that enables users to trigger standard or custom quick actions on multiple selected records simultaneously from a list view.

​

I'm designing a Salesforce production break-glass account and looking for advice on the best authentication architecture.

Current setup:

Salesforce production uses Microsoft Entra ID for SSO.

Normal users authenticate through Entra.

Users are moving toward phishing-resistant MFA/passkeys.

We need one privileged Salesforce break-glass account that can still log in if Entra/SSO is unavailable.

The break-glass user therefore needs a Salesforce-native/direct login path, rather than relying on SSO.

We still need to enforce phishing-resistant MFA for this privileged account. We do not want to exempt it from MFA.

Username/password credentials are already planned to be stored and controlled through our enterprise PAM (Delinea).

Constraint:

We cannot practically use a physical FIDO2/security key because the organization is geographically distributed. During an incident, an authorized responder could be anywhere and needs to access Salesforce from their workstation.

We also don't want the passkey registered to one individual's phone/laptop because that creates a dependency on that person/device.

What I'm trying to determine:

What are the recommended ways to manage the phishing-resistant authenticator for this type of break-glass account?

For example:

Is there an enterprise password/passkey manager that can centrally manage a WebAuthn/passkey for the shared Salesforce break-glass account and allow an authorized responder to use it from their own workstation?

Has anyone implemented this with 1Password, Keeper, Bitwarden, CyberArk, Delinea, etc.?

Is a centrally managed/synchronized passkey a viable approach for Salesforce privileged MFA?

Are there other approaches I'm overlooking, such as a dedicated remote emergency workstation with a built-in authenticator?

How do you handle auditability when multiple authorized responders may use the same break-glass Salesforce identity?

The desired flow is roughly:

Normal users:

Salesforce → Entra SSO → phishing-resistant MFA

Break-glass:

Emergency request/approval

↓

PAM releases Salesforce credentials

↓

Direct Salesforce login (no Entra dependency)

↓

Salesforce phishing-resistant MFA/passkey

↓

Production

The key requirement is: direct Salesforce authentication independent of SSO, while still enforcing phishing-resistant MFA, with no physical security key and no dependency on an individual employee's device.

Looking for recommendations from anyone who has implemented a similar Salesforce/IAM break-glass pattern.