Set Up and Maintain Your Salesforce Organization Activations
Session Type
WDC_API
Description
A session using the Work.com API. This is always a child session and cannot be used in the user interface.
SEE ALSO:
The Elements of User Authentication
User Sessions
Activations
Activation tracks information about devices from which users have verified their identity. Salesforce prompts users to verify their identity when they access Salesforce from an unrecognized browser or application. Identity verification adds an extra layer of security on top of username and password authentication. The Activations page lists the login IP addresses and client browsers used.
When a user logs in from outside a trusted IP range and uses a browser or app we don’t recognize, the user is challenged to verify identity. We use the highest-priority verification method available for each user. In order of priority, the methods are:
1. Verification via push notification or location-based automated verification with the Salesforce
Authenticator mobile app (version 2 or later) connected to the user’s account.
2. Verification via a U2F security key registered with the user’s account.
3. Verification code generated by a mobile authenticator app connected to the user’s account.
4. Verification code sent via SMS to the user’s verified mobile phone.
EDITIONS
Available in: Both Salesforce
Classic and Lightning
Experience
Available in all editions
5. Verification code sent via email to the user’s email address.
After identity verification is successful, the user doesn’t have to verify identity again from that browser or app, unless the user:
•
Manually clears browser cookies, sets the browser to delete cookies, or browses in private or incognito mode
•
Deselects Don’t ask again on the identity verification page
The Activations page in Setup lists the login IP addresses and client browser information of devices from which users have verified their identity. You can revoke the browser activation status for one, many, or all users.
For example, a user reports a lost device and is issued a new one. You can revoke the activation status of the browser on the lost device so that anyone attempting to access the org from that device has to verify their identity. This identity verification adds a layer of security while allowing users to stay productive.
Users can view their own Activations page to check their login IP addresses and client browser information. End users can revoke the activation status only for their own activated browsers.
For example, a user logs in to the org. On the user’s Activations page, several different browsers are activated, but the user has only logged in from a single browser on a work laptop. The user immediately revokes the activation status of those browsers the user doesn’t recognize. Because this user is challenged for identity verification using a code sent via SMS to the user’s mobile device, anyone else who tries to log in from one of the deactivated browsers can’t get the texted verification code. Without the code, the hacker fails the identity verification challenge. The user can then report the potential security breach.
541
