Salesforce Security Guide

Salesforce Security Guide
Salesforce Security Basics
Authenticate Users
Elements of User Authentication
Passwords
Cookies
Single Sign-On
My Domain
Two-Factor Authentication
Network-Based Security
Device Activation
Session Security
Custom Login Flows
Single Sign-On
Desktop Client Access
Configure User Authentication
Connected Apps
Give Users Access to Data
Share Objects and Fields
Strengthen Your Data's Security with Shield Platform Encryption
Monitoring Your Organization’s Security
Real-Time Event Monitoring
Security Guidelines for Apex and Visualforce Development
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Device Activation

Device activation tracks information about the devices from which users have verified their identity. Salesforce prompts users to verify their identity when they access Salesforce from an unrecognized browser or application. Device activation is an extra layer of security on top of username and password authentication.
Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: Essentials, Group, Professional, Enterprise, Performance, Unlimited, Developer, and Contact Manager Editions

When a user logs in from outside a trusted IP range from an unrecognized browser or app, Salesforce challenges the user to verify identity. Salesforce uses the highest-priority verification method available for each user. In order of priority, the methods are:
  1. Push notification or location-based automated verification with the Salesforce Authenticator mobile app (version 2 or later) connected to the user’s account
  2. U2F security key registered with the user’s account
  3. Verification code generated by a mobile authenticator app connected to the user’s account
  4. Verification code sent via SMS to the user’s verified mobile device
  5. Verification code sent via email to the user’s registered email address