salesforce_security_impl_guide

Configuring Salesforce Security Features
Setting Session Security
• Two-Factor Authentication — High Assurance
• Authentication Provider — Standard
• SAML — Standard
Note: The security level for a SAML session can also be specified using the SessionLevel attribute of the SAML assertion
sent by the identity provider. The attribute can take one of two values, STANDARD or HIGH_ASSURANCE .
To change the security level associated with a login method:
1. From Setup, click Security Controls > Session Settings.
2. Under Session Security Levels, select the login method.
3. Click the Add or Remove arrow to move it to the proper category.
Currently, the only features that use session-level security are connected apps, reports, and dashboards. You can set policies requiring
High Assurance on these types of resources and specify an action to take if the session used to access the resource is not High Assurance.
The two supported actions are:
• Block — This blocks access to the resource by showing an insufficient privileges error.
• Raise session level — This redirects you to a Two-Factor Authentication flow for raising the session’s security level to High Assurance.
Once you complete the flow successfully, you can access the resource.
To set a High Assurance required policy for accessing a connected app:
1. From Setup, go to Administer > Manage Apps > Connected Apps.
2. Click Edit next to the connected app.
3. Select High Assurance session required.
4. Select one of the two actions presented.
5. Click Save.
To set a High Assurance required policy for accessing reports and dashboards:
1. From Setup, go to Build > Customize > Reports & Dashboards > Access Policies.
2. Select the High Assurance session required.
3. Select one of the two actions presented.
4. Click Save.
The session levels have no impact on any resources in the app other than connected apps, reports, and dashboards for which explicit
security policies have been defined.
86