Salesforce Security Guide
jNewer Version Available
Set Up Two-Factor Authentication
Admins enable two-factor authentication through permissions or profile settings. Users add the mobile authenticator app
through their own personal settings.
| Available in: Both Salesforce Classic and Lightning Experience |
| Available in: Group, Professional, Enterprise, Performance, Unlimited, Developer, and Contact Manager Editions |
You can customize two-factor authentication in the following ways.
- Require it for every login. Set the two-factor login requirement for every time the user logs in to Salesforce. You can also enable this feature for API logins, which
includes the use of client applications like the Data Loader. For more information, see Set Two-Factor Authentication Login Requirements or Set Two-Factor Authentication Login Requirements for API Access.
Walk Through It: Secure Logins with Two-Factor
Authentication - Use “stepped up” authentication (also known as “high assurance” authentication). Sometimes you don’t need two-factor authentication for every user’s login, but you want to secure certain resources. If the user tries to use a connected app or reports, Salesforce prompts the user to verify identity. For more information, see Session Security Levels.
- Use profile policies and session settings. First, in the user profile, set the Session security level required at login field to High Assurance. Then set session security levels in your org’s session settings to apply the policy for particular login methods. In your org’s session settings, check the session security levels to make sure that Two-Factor Authentication is in the High Assurance column. For more information, see Set Two-Factor Authentication Login Requirements for Single Sign-On, Social Sign-On, and Communities.
- Use login flows. Use the Flow Designer and profiles to build post-authentication requirements as the user logs in, including custom two-factor authentication processes. For more information, see the following examples.