What Is Salesforce Identity?

Salesforce Identity is an identity and access management (IAM) service with the following features.

• Cloud-based user directories, so user accounts and information are stored and maintained in one place, while available to other services or apps.
• Authentication services to verify users and keep granular control over user access. You can require multi-factor authentication (formerly called two-factor authentication), select which apps users can use, and set how often individual users log in to maintain their session.
• Access management and authorization for third-party apps, including UI integration, so a user’s apps and services are readily available.
• App user provisioning, which streamlines the process for providing and removing access to apps to multiple users simultaneously.
• An API for viewing and managing Identity features.
• Identity event logs for creating reports and dashboards on single sign-on (SSO) and connected app usage.
• Salesforce Identity Connect for integrating Microsoft Active Directory (AD) with Salesforce. Identity Connect allows you to manage AD users and Salesforce users simultaneously. You can configure Identity Connect to give AD users access to their Salesforce orgs without logging in again.

To implement Salesforce Identity, use any of the following.

Security Assertion Markup Language (SAML)

Security Assertion Markup Language (SAML) is an XML-based protocol that allows you to transfer user information between services, for example, from Salesforce to Microsoft 365. Apps use this information to authorize users and enable SSO. Salesforce supports SAML for SSO into Salesforce from a corporate portal or identity provider.

OAuth 2.0

OAuth 2.0 is an open protocol used to allow secure authorization between apps. OAuth authorization flows describe the options for implementing OAuth in Salesforce orgs. For more information on specific flows, see REST API Developer Guide.

OpenID Connect

Open ID Connect is an authentication protocol based on OAuth 2.0 that sends identity information between services. With OpenID Connect, users can log in to another service, like Gmail, and then access their Salesforce org without logging in again.

My Domain

My Domain allows you to define your own domain name within the Salesforce domain (for example, https://companyname.my.salesforce.com). My Domain makes it easier to manage login and authentication and allows you to customize your login page. Salesforce requires My Domain if you want to use some features, including Lightning components in Lightning tabs, Lightning pages, or as a standalone app.

Connected Apps

A connected app is a framework that enables an external application to integrate with Salesforce using APIs and standard protocols, such as SAML, OAuth, and OpenID Connect. Connected apps use these protocols to authenticate, authorize, and provide single sign-on (SSO) for external apps. The external apps that are integrated with Salesforce can run on the customer success platform, other platforms, devices, or SaaS subscriptions. For example, when you log in to your Salesforce mobile app and see your data from your Salesforce org, you’re using a connected app.

App Launcher

The App Launcher gives your users easy access to apps that they use most often. Users go to the App Launcher to launch Salesforce, on-premises, and connected (third-party) apps without logging in again (referred to as single sign-on). The App Launcher displays tiles that link to the available apps. It’s available to all Lightning Experience users. Salesforce Classic users must have the Use Identity Features permission to get the App Launcher.

Identity Licenses

See Salesforce Identity Licenses.

Identity Provider and Service Provider integration

An identity provider is a trusted provider that lets you use single sign-on (SSO) to access other websites. A service provider is a website that hosts apps. You can enable Salesforce as an identity provider and define one or more service providers. Your users can then access other apps directly from Salesforce using SSO. SSO is a great help to your users—instead of having to remember many passwords, they only have to remember one.

Salesforce Identity Connect

Identity Connect integrates Microsoft Active Directory (AD) user accounts with Salesforce user records. When a user account is created or updated in AD, Identity Connect pushes those updates to the Salesforce user record seamlessly and instantaneously. For example, when a user is created in AD, the Salesforce user record is created as part of the provisioning process. When deprovisioned, the user’s Salesforce session is revoked immediately. You can also use Identity Connect for single sign-on to Salesforce.

Multi-Factor Authentication

Multi-factor authentication (MFA) is one of the easiest, most effective tools for enhancing login security, and safeguarding your business and data against security threats. As you roll out your Salesforce MFA implementation, you can customize it to meet your business needs.