# Login auditing, Event Monitoring and login flows

*Platform Identity and Access Management Architect Study Guide · Access Management Best Practices · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/access-management-best-practices/login-auditing-event-monitoring-and-login-flows*

Which tool answers which audit question during and after login: Session Management for live sessions, Identity Verification History and the methods report for MFA, Event Monitoring, Real-Time Event Monitoring, transaction security and Threat Detection for activity and attacks, and login flows for checks that run at every login.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Access Management Best Practices
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, describe which tools you can apply to audit and verify the activity/user during and after login.

## What the exam expects

- Match an audit question to the tool that answers it: active sessions, past logins, verification attempts, registered methods, setup changes, or actions taken after login.
- Know which tools need Salesforce Shield or the Event Monitoring add-on and which come with every org.
- Use Event Monitoring, Real-Time Event Monitoring (LoginEvent, LoginEventStream, LoginKey), transaction security policies and Threat Detection for Login As activity, session tracing, blocking and attack detection.
- Use a login flow to verify or collect data at every login, and know where it doesn't run.

Key terms: **Session Management** (Setup page of active sessions); **Identity Verification History** (log of MFA and other verification attempts); **Real-Time Event Monitoring** (streaming and stored events such as LoginEventStream and LoginEvent); **transaction security policy** (conditions on an event plus Block, Multi-Factor Authentication or Notifications); **login flow** (screen flow or Visualforce page run after authentication for a profile).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Session Management | All editions; active sessions only; Remove forces a new login | [Session Management](https://help.salesforce.com/s/articleView?id=xcloud.security_user_session_info.htm&language=en_US&type=5) |
| Token revocation on Remove | Immediate for most services, up to 30 minutes for some | [Session Management](https://help.salesforce.com/s/articleView?id=xcloud.security_user_session_info.htm&language=en_US&type=5) |
| Identity Verification History | Up to 20,000 attempts, past 6 months | [Identity Verification History](https://help.salesforce.com/s/articleView?id=xcloud.security_verification_history.htm&language=en_US&type=5) |
| Device activation | Unrecognized device or new IP; risk-based authentication | [Identity Verification History](https://help.salesforce.com/s/articleView?id=xcloud.security_verification_history.htm&language=en_US&type=5) |
| Registered methods | Identity Verification Methods report or user list view | [Monitor and Audit Security](https://help.salesforce.com/s/articleView?id=xcloud.security_audit.htm&language=en_US&type=5) |
| Event Monitoring licensing | Shield or Event Monitoring add-on | [Event Monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_overview.htm&language=en_US&type=5) |
| LoginKey | Ties all events in one login session together | [LoginEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_loginevent.htm) |
| Streaming vs policy | LoginEventStream streams; LoginEvent stores and drives policies | [Event Monitoring Considerations](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_considerations.htm&language=en_US&type=5) |
| Threat events | Session hijacking and credential stuffing support Notifications only | [Transaction Security](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_policy_types.htm&language=en_US&type=5) |
| Login flow assignment | Designated login flow, associated per profile | [Custom Login Flows](https://help.salesforce.com/s/articleView?id=xcloud.security_login_flow.htm&language=en_US&type=5) |
| Login flows and API | Not applied to API logins | [Custom Login Flows](https://help.salesforce.com/s/articleView?id=xcloud.security_login_flow.htm&language=en_US&type=5) |

## Check yourself

- Why can't Login History end a session from an unexpected country?
- When does Identity Verification History show Device activation in Triggered By?
- Which tools need no Shield or Event Monitoring license?
- Why does a login flow reach SAML users but not Data Loader?

## Sources

- [View User Session Information on the Session Management Page](https://help.salesforce.com/s/articleView?id=xcloud.security_user_session_info.htm&language=en_US&type=5)
- [Event Monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_overview.htm&language=en_US&type=5)
- [Transaction Security](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_policy_types.htm&language=en_US&type=5)
- [Considerations for Using Event Monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_considerations.htm&language=en_US&type=5)
- [Condition Builder Examples](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_cb_examples.htm&language=en_US&type=5)
- [LoginEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_loginevent.htm)
- [Monitor Identity Verification History](https://help.salesforce.com/s/articleView?id=xcloud.security_verification_history.htm&language=en_US&type=5)
- [Monitor and Audit Security in Salesforce](https://help.salesforce.com/s/articleView?id=xcloud.security_audit.htm&language=en_US&type=5)
- [Monitor Login History](https://help.salesforce.com/s/articleView?id=xcloud.users_login_history.htm&language=en_US&type=5)
- [Monitor Setup Changes with Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5)
- [Custom Login Flows](https://help.salesforce.com/s/articleView?id=xcloud.security_login_flow.htm&language=en_US&type=5)
- [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams