salesforce_security_impl_guide

Configuring Salesforce Security Features
Setting Two-Factor Authentication Login Requirements
Setting Two-Factor Authentication Login Requirements
Administrators can require users to enter a time-based token generated from an authenticator app
when they log into Salesforce.
To require this verification every time users log into Salesforce, select the “Two-Factor Authentication
for User Interface Logins” permission in the user profile or permission set.
Note:
Enhancing Security with Two-Factor Authentication (6:56 minutes)
See a demonstration of Two-Factor Authentication for Salesforce, and when to use it.
Users are prompted to add a time-based token the next time they log into Salesforce. They must
enter the changing token from their mobile app every time they log in.
Note: Users aren’t asked for a verification code the first time they log in to Salesforce.
Once users add a time-based token to their account they can also use the token to confirm their
identity when they activate their computer. Partner Portal and Customer Portal users aren’t required
to activate computers to log in.
EDITIONS
Available in:
• Enterprise
• Performance
• Unlimited
• Developer
• Database.com
USER PERMISSIONS
To edit profiles and
permission sets:
• “Manage Profiles and
Permission Sets”
IN THIS SECTION:
Adding a Time-Based Token
You can add a time-based token to your account to use a mobile authenticator app to activate your computer.
Removing or Resetting Time-Based Token Keys
Only one time-based token can be stored on a user’s account. The user must use the authenticator app on the same mobile device
to retrieve the token. If a user can’t access the mobile authenticator app used to add the time-based token, administrators can remove
the key used to generate the token to deactivate it.
Adding a Time-Based Token
You can add a time-based token to your account to use a mobile authenticator app to activate your
computer.
Once you add a time-based token to your account, you’ll be prompted to enter the changing token
stored in the mobile app whenever Salesforce needs to confirm your identity, such as when you
log in from an unknown IP address.
EDITIONS
Available in all editions
Note: If you have the “Two-Factor Authentication for User Interface Logins” permission, you must enter this token every time you
log into Salesforce through the user interface. If you have the “Two-Factor Authentication for API Logins” permission, you must
enter this token to access the service instead of the standard security token.
1. Download the supported authenticator app for the type of mobile device you’re using.
2. From your user detail page in Salesforce, click Add next to Time-Based Token.
3. For security purposes, you’re prompted to log into your account.
4. Scan the QR code with the authenticator app on your mobile device.
Alternatively, you can manually enter your username and the key displayed when you click Can’t scan the QR code into the app.
5. Enter the token generated from the mobile app into the Token field in Salesforce.
87