Salesforce Security Guide

Salesforce Security Guide
Salesforce Security Basics
Authenticate Users
Elements of User Authentication
Configure User Authentication
Restrict Where and When Users Can Log In to Salesforce
Set Password Policies
Expire Passwords for All Users
Modify Session Security Settings
Define Identity Verification Settings for Your Orgs and Communities
Require High-Assurance Session Security for Sensitive Operations
Custom Login Flows
Set Up a Login Flow and Connect to Profiles
Login Flow Examples
Multi-Factor Authentication Considerations
Set Multi-Factor Authentication Login Requirements
Set Multi-Factor Authentication Login Requirements for API Access
Connect Salesforce Authenticator (Version 3 or Later) to Your Account for Identity Verification
Verify Your Identity with a TOTP Authenticator App
Disconnect Salesforce Authenticator (Versions 2 and 3) from a User’s Account
Disconnect a User’s TOTP Authenticator App
Generate a Temporary Identity Verification Code
Expire a Temporary Verification Code
Implement Multi-Factor Authentication with Apex
Delegate Multi-Factor Authentication Management Tasks
Deploy Third-Party, SMS-Based Multi-Factor Authentication
Limit the Number of Concurrent Sessions with Login Flows
Connected Apps
Give Users Access to Data
Share Objects and Fields
Strengthen Your Data's Security with Shield Platform Encryption
Monitoring Your Organization’s Security
Real-Time Event Monitoring
Security Guidelines for Apex and Visualforce Development
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Delegate Multi-Factor Authentication Management Tasks

Let users who aren’t Salesforce admins provide support for multi-factor authentication (MFA) in your org. For example, suppose you want your company’s Help Desk staff to generate temporary verification codes for users who lost or forgot the device they usually use for MFA. Assign Help Desk staff members the Manage Multi-Factor Authentication in User Interface user permission so that they can generate codes and support end users with other MFA tasks.
Available in: Both Salesforce Classic and Lightning Experience
Available in: Essentials, Contact Manager, Group, Professional, Enterprise, Performance, Unlimited, and Developer Editions

User Permissions Needed
To edit profiles and permission sets: Manage Profiles and Permission Sets
To assign the permission, select Manage Multi-Factor Authentication in User Interface in a custom user profile or permission set. Users with the permission can perform the following tasks.
  • Generate a temporary verification code for a user who can’t access their usual MFA verification methods.
  • Disconnect verification methods from a user’s account when the user loses or replaces a device.
  • View user identity verification activity on the Identity Verification History page.
  • View the Identity Verification Methods report by clicking a link on the Identity Verification History page.
  • Create user list views that show which identity verification methods users have registered.

Although non-admin users with the permission can view the Identity Verification Methods report, they can’t create custom reports that include data restricted to users with the Manage Users permission.

Note