Salesforce Security Guide

Salesforce Security Guide
Salesforce Security Basics
Authenticate Users
Elements of User Authentication
Configure User Authentication
Restrict Where and When Users Can Log In to Salesforce
Set Password Policies
Expire Passwords for All Users
Modify Session Security Settings
Define Identity Verification Settings for Your Orgs and Experience Cloud Sites
Require High-Assurance Session Security for Sensitive Operations
Custom Login Flows
Set Up a Login Flow and Connect to Profiles
Login Flow Examples
Multi-Factor Authentication Customizations
Deploy Third-Party, SMS-Based Multi-Factor Authentication
Limit the Number of Concurrent Sessions with Login Flows
Connected Apps
Give Users Access to Data
Share Objects and Fields
Strengthen Your Data's Security with Shield Platform Encryption
Monitoring Your Organization’s Security
Real-Time Event Monitoring
Security Guidelines for Apex and Visualforce Development
API End-of-Life
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Expire Passwords for All Users

As an admin, you can expire passwords for all users anytime you want to enforce extra security for your Salesforce org. After expiring passwords, all users are prompted to reset their password the next time they log in.
Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience
Available in: Professional, Enterprise, Performance, Unlimited, Developer, and Database.com Editions

User Permissions Needed
To expire all passwords: Reset User Passwords and Unlock Users

To prevent admins from expiring passwords for all users in the org, contact Salesforce Customer Support.

Note

To expire passwords for all users, except those users with profiles that have the Password Never Expires user permission:
  1. From Setup, enter Expire All Passwords in the Quick Find box, then select Expire All Passwords.
  2. Select Expire all user passwords.
  3. Click Save.

The next time users log in, they’re prompted to reset their password.

Considerations When Expiring Passwords

  • Users might be prompted to activate their devices to log in to Salesforce.
  • Expire all user passwords doesn’t affect Self-Service portal users because they aren’t direct Salesforce users.