Security Implementation Guide

Salesforce Security Implementation Guide
Security Overview
User Authentication
Passwords
Single Sign-on Overview
My Domain
Identity Providers
Network-Based Security
Session Security
Custom Login Flows
Configure User Authentication
Setting Login Restrictions
Set Password Policies
Expire Passwords for Your Users
Set Trusted IP Ranges for Your Organization
Modify Session Security Settings
Create a Login Flow
Connect a Login Flow to a Profile
Salesforce Two-Factor Authentication
Set Two-Factor Authentication Login Requirements
Set Two-Factor Authentication Requirements for API Access
Connect a One-Time Password Generator App or Device
Remove or Reset a User’s One-Time Password Generator App
Enabling Single Sign-On
Connected Apps
Desktop Client Access
User Authorization
Data Sharing Tools
Monitoring Your Organization's Security
Platform Encryption
Security Tips for Apex and Visualforce Development
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Connect a One-Time Password Generator App or Device

You can connect a one-time password generator app, such as Salesforce Authenticator or Google Authenticator, to your account. If your administrator requires a verification code when you log in for increased security (called “two-factor authentication”), use the code generated by the app. You can also use a code generated by the app whenever we have to verify your identity.
Available in: Both Salesforce Classic and Lightning Experience
Available in: All Editions

This additional level of security is a second “factor” of authentication. If your administrator has set this requirement, you have to configure this additional factor (usually an authenticator app that displays a code, such as Salesforce Authenticator or Google Authenticator) for your account. This additional factor of authentication generates your verification code, also called a “time-based one-time password” (usually a numeric code). Once you connect the one-time password generator to your account, you’re prompted to enter the code from the authenticator app whenever you log in to Salesforce.

  1. Download the supported authenticator app for the type of device you use. You can use any authenticator app that supports the time-based one-time password (TOTP) algorithm ( IETF RFC 6238), such as Salesforce Authenticator for iOS, Salesforce Authenticator for Android, and Google Authenticator.
  2. From your personal settings, enter Advanced User Details in the Quick Find box, then select Advanced User Details. No results? Enter Personal Information in the Quick Find box, then select Personal Information.
  3. Find App Registration: One-Time Password Generator and click Connect.
  4. For security purposes, you’re prompted to log in to your account.
  5. Scan the QR code with the authenticator app on your mobile device.
    Alternatively, you can manually enter your username and the key displayed when you click I Can’t Scan the QR Code into the app.
  6. Enter the code generated by the authenticator app into the Verification Code field in Salesforce.
    The authenticator app generates a new verification code, periodically. Enter the current code.
  7. Click Connect.