Set Up and Maintain Your Salesforce Organization Passwords
Column name
Amount Used
Last Updated
Description
The amount of this resource that your org is using.
The most recent date and time when Salesforce took a snapshot of your org’s usage for this resource.
For more information about resources your org is entitled to, contact Salesforce.
SEE ALSO:
Usage-based Entitlements
View Your Salesforce Org’s Usage-Based Entitlements
Passwords
Salesforce provides each user in your organization with a unique username and password that must be entered each time a user logs in. As an administrator, you can configure several settings to ensure that your users’ passwords are strong and secure.
•
Password policies—Set various password and login policies, such as specifying an amount of time before all users’ passwords expire and the level of complexity required for passwords. See
Set Password Policies on page 581.
•
User password expiration—Expire the passwords for all users in your organization, except for users with “Password Never Expires” permission. See
Expire Passwords for All Users
on page
584.
•
User password resets—Reset the password for specified users. See Reset Passwords for Your
Users
on page 252.
•
Login attempts and lockout periods—If a user is locked out of Salesforce because of too many
failed login attempts, you can unlock them. See Edit Users on page 197.
Password Requirements
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Password policies available in: All Editions
USER PERMISSIONS
To set password policies:
•
Manage Password
Policies
To reset user passwords and unlock users:
•
Reset User Passwords and Unlock Users
A password can’t contain a user’s username and can’t match a user’s first or last name. Passwords also can’t be too simple. For example, a user can’t change their password to
password
.
For all editions, a new organization has the following default password requirements. You can change these password policies in all editions, except for Personal Edition.
•
A password must contain at least eight characters, including one alphabetic character and one number.
•
The security question’s answer can’t contain the user’s password.
•
When users change their password, they can’t reuse their last three passwords.
IN THIS SECTION:
Set Password Policies
Improve your Salesforce org security with password protection. You can set password history, length, and complexity requirements along with other values. In addition, you can specify what to do if a user forgets their password.
248
Set Up and Maintain Your Salesforce Organization Passwords
Reset Passwords for Your Users
As an administrator, you can reset a user’s password for better protection or to unlock a user if the user is locked out.
Expire Passwords for All Users
As an administrator, you can expire passwords for all users any time you want to enforce extra security for your organization. After expiring passwords, all users are prompted to reset their password the next time they log in.
SEE ALSO:
Change Your Password
Set Password Policies
Improve your Salesforce org security with password protection. You can set password history, length, and complexity requirements along with other values. In addition, you can specify what to do if a user forgets their password.
For your organization’s security, you can set various password and login policies.
Note: User passwords cannot exceed 16,000 bytes.
Logins are limited to 3,600 per hour per user. This limit applies to organizations created after
Summer ’08.
1. From Setup, enter
Password Policies
in the
Quick Find
box, then select Password
Policies.
2. Customize the password settings.
Field
User passwords expire in
Enforce password history
Description
The length of time until user passwords expire and must be changed. The default is 90 days.
This setting isn’t available for Self-Service portals. This setting doesn’t apply to users with the “Password Never Expires” permission.
If you change the
User passwords expire in
setting, the change affects a user’s password expiration date if that user’s new expiration date is earlier than the old expiration date or if you remove an expiration by selecting
Never expires
.
Save users’ previous passwords so that they must always reset their password to a new, unique password. Password history is not saved until you set this value. The default is
3 passwords remembered
. You cannot select
No passwords remembered unless you select
Never expires
for the
User passwords expire in
field.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Essentials,
Group, Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
USER PERMISSIONS
To set password policies:
•
Manage Password
Policies
249
Set Up and Maintain Your Salesforce Organization
Field
Minimum password length
Password complexity requirement
Password question requirement
Maximum invalid login attempts
Lockout effective period
250
Passwords
Description
This setting isn’t available for Self-Service portals.
The minimum number of characters required for a password.
When you set this value, existing users aren’t affected until the next time they change their passwords. The default is
8 characters
.
The requirement for which types of characters must be used in a user’s password.
Complexity levels:
•
No restriction
—allows any password value and is the least secure option.
•
Must mix alpha and numeric characters
—requires at least one alphabetic character and one number, which is the default.
•
Must mix alpha, numeric, and special characters
—requires at least one alphabetic character, one number, and one of the following special characters:
!
# $ % - _ = + < >
.
•
Must mix numbers and uppercase and lowercase letters
—requires at least one number, one uppercase letter, and one lowercase letter.
•
Must mix numbers, uppercase and lowercase letters, and special characters
—requires at least one number, one uppercase letter, and one lowercase letter, and one of the following special characters:
! # $ % - _ = + < >
.
Note: Only the special characters listed meet the requirement. Other symbol characters are not considered special characters.
The values are
Cannot contain password
, meaning that the answer to the password hint question cannot contain the password itself; or
None
, the default, for no restrictions on the answer. The user’s answer to the password hint question is required. This setting is not available for Self-Service portals,
Customer Portals, or partner portals.
The number of login failures allowed for a user before they become locked out. This setting isn’t available for Self-Service portals.
The duration of the login lockout. The default is 15 minutes. This setting isn’t available for Self-Service portals.
Note: If users are locked out, they must wait until the lockout period expires. Alternatively, a user with the “Reset
Set Up and Maintain Your Salesforce Organization Passwords
Field Description
User Passwords and Unlock Users” permission can unlock them from Setup with the following procedure:
a. Enter
Users
in the
Quick Find
box.
b. Select Users.
c. Selecting the user.
d. Click Unlock.
This button is only available when a user is locked out.
Obscure secret answer for password resets
This feature hides answers to security questions as you type. The default is to show the answer in plain text.
Note:
If your org uses the Microsoft Input Method Editor
(IME) with the input mode set to Hiragana, when you type
ASCII characters, they’re converted in Japanese characters in normal text fields. However, the IME doesn’t work properly in fields with obscured text. If your org’s users cannot properly enter their passwords or other values after enabling this feature, disable the feature.
Require a minimum 1 day password lifetime
When you select this option, a password can’t be changed more than once in a 24-hour period.
3. Customize the forgotten password and locked account assistance information.
Note: This setting is not available for Self-Service portals, Customer Portals, or partner portals.
Field
Message
Help link
Description
If set, this message appears in the “We can’t reset your password” email. Users receive this email when they lock themselves out by trying to reset their password too many times. The text also appears at the bottom of the Answer Your Security Question page when users reset their passwords.
You can tailor the text to your organization by adding the name of your internal help desk or a system administrator. For the email, the message appears only for accounts that need an administrator to reset them. Lockouts due to time restrictions get a different system email message.
If set, this link displays with the text defined in the
Message field. In the “We can’t reset your password” email, the URL displays exactly as typed in the
Help link
field, so the user can see
251
Set Up and Maintain Your Salesforce Organization
Field
Passwords
Description
where the link goes. This URL display format is a security feature, because the user is not within a Salesforce organization.
On the Answer Your Security Question page, the
Help link
URL combines with the text in the
Message
field to make a clickable link. Security isn’t an issue, because the user is in a
Salesforce organization when changing passwords.
Valid protocols:
•
http
•
https
•
mailto
4. Specify an alternative home page for users with the “API Only User” permission. After completing user management tasks such as resetting a password, API-only users are redirected to the URL specified here, rather than to the login page.
5. Click Save.
SEE ALSO:
View and Edit Password Policies in Profiles
Passwords
Reset Passwords for Your Users
As an administrator, you can reset a user’s password for better protection or to unlock a user if the user is locked out.
To reset a user’s password:
1. From Setup, enter
Users
in the
Quick Find
box, then select Users.
2. Select the checkbox next to the user’s name. Optionally, to change the passwords for all currently displayed users, check the box in the column header to select all rows.
3. Click Reset Password. The user receives an email that contains a link and instructions to reset the password.
A password created this way doesn’t expire, but users must change the password the first time they log in.
Tip: You can perform this and other administration tasks from the SalesforceA mobile app.
EDITIONS
Available in: Salesforce
Classic and Lightning
Experience
Available in: Contact
Manager, Essentials,
Group, Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Considerations for Resetting Passwords
•
Only an administrator can reset single sign-on user passwords. Single sign-on users can’t reset their own passwords.
•
After resetting a password, users might be required to activate their computers to successfully log in to Salesforce.
•
Resetting a locked-out user’s password automatically unlocks the user’s account.
USER PERMISSIONS
To reset passwords:
•
Reset User Passwords and Unlock Users
OR
Permission to edit the user via the user interface or the API
252
Set Up and Maintain Your Salesforce Organization Passwords
•
When a user loses a password, the user can click the forgot password link on the login page to receive an email with steps to reset a password. The user must correctly answer the security question to reset the password. In Password Policies, you can customize the security question page that the user sees with information about where to go to for help.
Note: If the user hasn’t set a security question, or doesn’t answer the security question correctly, the password isn’t reset.
A user can request to reset a password through the forgot password link a maximum of five times in a 24-hour period.
Administrators can reset a user’s password as often as needed.
•
Resetting a password also resets the user’s security token.
SEE ALSO:
Reset Your Forgotten Password
Change Your Password
Reset Your Security Token
Passwords
Help Users From Anywhere With SalesforceA
Expire Passwords for All Users
As an administrator, you can expire passwords for all users any time you want to enforce extra security for your organization. After expiring passwords, all users are prompted to reset their password the next time they log in.
To expire passwords for all users, except those users with the “Password Never Expires” permission:
1. From Setup, enter
Expire All Passwords
in the
Quick Find
box, then select
Expire All Passwords.
2. Select Expire all user passwords.
3. Click Save.
The next time users log in, they are prompted to reset their password.
EDITIONS
Available in: both Salesforce
Classic and Lightning
Experience
Available in: Professional,
Enterprise, Performance,
Unlimited, Developer, and
Database.com Editions
Considerations When Expiring Passwords
•
Users might need to activate their computers to log in to Salesforce.
•
Expire all user passwords
doesn’t affect Self-Service portal users, because they aren’t direct Salesforce users.
SEE ALSO:
Passwords
USER PERMISSIONS
To expire all passwords:
•
Reset User Passwords and Unlock Users
253
