# Login History and diagnostics for SSO monitoring

*Platform Identity and Access Management Architect Study Guide · Accepting Third-Party Identity in Salesforce · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/accepting-third-party-identity-in-salesforce/login-history-and-diagnostics-for-sso-monitoring*

How to monitor and diagnose logins that come from third-party identity: Login History fields, list views, downloads and SOQL (Login Type, Login Subtype, Authentication Service ID, Authentication Method Reference), routing SAML failure statuses to the IdP or the admin team, Delegated Authentication Error History and status codes, and the Test-Only Initialization URL.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Accepting Third-Party Identity in Salesforce
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, identify the auditing and monitoring approaches available on the platform, and describe the tools available to diagnose issues.

## What the exam expects

- Use Login History in Setup, its list views, downloads and the LoginHistory object to answer monitoring questions about SSO logins.
- Pick the field that answers the question: Login Type, Login Subtype, Authentication Service ID or Authentication Method Reference.
- Route a failed SAML login by its status: assertion problems to the identity provider with SAML Assertion Validator output, configuration problems to the Salesforce admin.
- Diagnose delegated authentication with Login History status codes and Delegated Authentication Error History.
- Use the Test-Only Initialization URL to check an authentication provider before users rely on it.

Key terms: **Login History** (the record of every login attempt to the org and its Experience Cloud sites, with a status); **Login Type** (how the session was started, such as IdP-initiated or Salesforce-initiated SAML); **Authentication Service ID** (the SAML setting or authentication provider used); **Authentication Method Reference** (how an OpenID provider says it authenticated the user).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Login History page | Up to 20,000 records, past 6 months; download for more | [Monitor Login History](https://help.salesforce.com/s/articleView?id=xcloud.users_login_history.htm&language=en_US&type=5) |
| Access | Monitor Login History or Manage Users | [LoginHistory](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_loginhistory.htm) |
| Login Type values | `Saml` = IdP-initiated, `Saml2` = Salesforce-initiated, Third Party SSO | [LoginHistory](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_loginhistory.htm) |
| AuthenticationServiceId | References an AuthProvider or SamlSsoConfig record | [LoginHistory](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_loginhistory.htm) |
| Authentication Method Reference | How an OpenID provider authenticated the user, e.g. MFA | [Monitor Login History](https://help.salesforce.com/s/articleView?id=xcloud.users_login_history.htm&language=en_US&type=5) |
| Assertion errors | Assertion Expired, Assertion Invalid, Audience Invalid | [SAML Login Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation_errors.htm&language=en_US&type=5) |
| Validator scope | Assertion errors only; failed assertion pre-filled when possible | [Troubleshoot SAML Assertion Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation.htm&language=en_US&type=5) |
| Delegated Authentication Error History | 21 most recent errors; Modify All Data | [Delegated Authentication Errors](https://help.salesforce.com/s/articleView?id=xcloud.users_viewing_single_signon_errors.htm&language=en_US&type=5) |
| Codes 30001-30003 | Invalid SSO URL, service down, credentials rejected | [Monitor Login History](https://help.salesforce.com/s/articleView?id=xcloud.users_login_history.htm&language=en_US&type=5) |

## Check yourself

- Why can't a Login Type list view tell apart logins through two different SAML settings?
- When should a failed SAML login go to the identity provider with validator output?
- When is the Test-Only Initialization URL the right tool?
- What does Delegated Authentication Error History show?

## Sources

- [Monitor Login History](https://help.salesforce.com/s/articleView?id=xcloud.users_login_history.htm&language=en_US&type=5)
- [Review the Login History](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_login_history.htm&language=en_US&type=5)
- [LoginHistory](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_loginhistory.htm)
- [SAML Login Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation_errors.htm&language=en_US&type=5)
- [Troubleshoot SAML Assertion Errors](https://help.salesforce.com/s/articleView?id=xcloud.sso_saml_validation.htm&language=en_US&type=5)
- [Troubleshoot Delegated Authentication Login Errors](https://help.salesforce.com/s/articleView?id=xcloud.users_viewing_single_signon_errors.htm&language=en_US&type=5)
- [Configure Salesforce for Delegated Authentication](https://help.salesforce.com/s/articleView?id=xcloud.sso_delauthentication_configuring.htm&language=en_US&type=5)
- [Add Functionality to an Authentication Provider](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_addl_params.htm&language=en_US&type=5)
- [Configure an Authentication Provider Using OpenID Connect](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 7 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams