Salesforce Security Guide

Salesforce Security Guide
Salesforce Security Basics
Authenticate Users
The Elements of User Authentication
Configure User Authentication
Restrict Where and When Users Can Log In to Salesforce
Set Password Policies
Expire Passwords for All Users
Modify Session Security Settings
Create a Login Flow
Connect a Login Flow to a Profile
Set Up Two-Factor Authentication
Set Two-Factor Authentication Login Requirements
Set Two-Factor Authentication Login Requirements for Single Sign-On, Social Sign-On, and Communities
Set Two-Factor Authentication Login Requirements for API Access
Connect Salesforce Authenticator (Version 2 or Later) to Your Account for Identity Verification
Connect a One-Time Password Generator App or Device for Identity Verification
Disconnect Salesforce Authenticator (Version 2 or Later) from a User’s Account
Disconnect a User’s One-Time Password Generator App
Generate a Temporary Identity Verification Code
Expire a Temporary Verification Code
Delegate Two-Factor Authentication Management Tasks
Give Users Access to Data
Share Objects and Fields
Protect Your Salesforce Data with Shield Platform Encryption
Monitoring Your Organization's Security
Security Tips for Apex and Visualforce Development
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Connect a One-Time Password Generator App or Device for Identity Verification

You can connect a one-time password generator app, such as Salesforce Authenticator or Google Authenticator, to your account. Use a verification code generated by the app, sometimes called a “time-based one-time password,” whenever Salesforce has to verify your identity. If your administrator requires two-factor authentication for increased security when you log in, access connected apps, or access reports or dashboards, use a code from the app. If you’re required to use two-factor authentication before you have an app connected, you’re prompted to connect one the next time you log in to Salesforce. If you don’t yet have the two-factor authentication requirement, you can still connect the app to your account through your personal settings.
Available in: Both Salesforce Classic and Lightning Experience
Available in: All Editions

  1. Download the supported authenticator app for your device type. You can use any authenticator app that supports the time-based one-time password (TOTP) algorithm ( IETF RFC 6238), such as Salesforce Authenticator for iOS, Salesforce Authenticator for Android, or Google Authenticator.
  2. From your personal settings, enter Advanced User Details in the Quick Find box, then select Advanced User Details. No results? Enter Personal Information in the Quick Find box, then select Personal Information.
  3. Find App Registration: One-Time Password Generator and click Connect.
  4. For security purposes, you’re prompted to log in to your account.
  5. Using the authenticator app on your mobile device, scan the QR code.
    Alternatively, you can click I Can’t Scan the QR Code in your browser. The browser displays a security key. In the authenticator app, enter your username and the key displayed.
  6. In Salesforce, enter the code generated by the authenticator app in the Verification Code field.
    The authenticator app generates a new verification code periodically. Enter the current code.
  7. Click Connect.
To help keep your account secure, we send you an email notification whenever a new identity verification method is added to your Salesforce account. You get the email whether you add the method or your Salesforce admin adds it on your behalf.