Login History and diagnostics for SSO monitoring
How to monitor and diagnose logins that come from third-party identity: Login History fields, list views, downloads and SOQL (Login Type, Login Subtype, Authentication Service ID, Authentication Method Reference), routing SAML failure statuses to the IdP or the admin team, Delegated Authentication Error History and status codes, and the Test-Only Initialization URL.
Given a scenario, identify the auditing and monitoring approaches available on the platform, and describe the tools available to diagnose issues.
~7 min read · 7 practice questions ·
What the exam expects
- Use Login History in Setup, its list views, downloads and the LoginHistory object to answer monitoring questions about SSO logins.
- Pick the field that answers the question: Login Type, Login Subtype, Authentication Service ID or Authentication Method Reference.
- Route a failed SAML login by its status: assertion problems to the identity provider with SAML Assertion Validator output, configuration problems to the Salesforce admin.
- Diagnose delegated authentication with Login History status codes and Delegated Authentication Error History.
- Use the Test-Only Initialization URL to check an authentication provider before users rely on it.
Key terms: Login History (the record of every login attempt to the org and its Experience Cloud sites, with a status); Login Type (how the session was started, such as IdP-initiated or Salesforce-initiated SAML); Authentication Service ID (the SAML setting or authentication provider used); Authentication Method Reference (how an OpenID provider says it authenticated the user).
Key facts
- Detail
- Up to 20,000 records, past 6 months; download for more
- Detail
- Monitor Login History or Manage Users
- Detail
Saml= IdP-initiated,Saml2= Salesforce-initiated, Third Party SSO
- Detail
- References an AuthProvider or SamlSsoConfig record
- Detail
- How an OpenID provider authenticated the user, e.g. MFA
- Detail
- Assertion Expired, Assertion Invalid, Audience Invalid
- Detail
- Assertion errors only; failed assertion pre-filled when possible
- Detail
- 21 most recent errors; Modify All Data
- Detail
- Invalid SSO URL, service down, credentials rejected
Sources for this section (5)
- Monitor Login Historyhelp.salesforce.com (opens in a new tab)
- LoginHistorydeveloper.salesforce.com (opens in a new tab)
- SAML Login Errorshelp.salesforce.com (opens in a new tab)
- Troubleshoot SAML Assertion Errorshelp.salesforce.com (opens in a new tab)
- Delegated Authentication Errorshelp.salesforce.com (opens in a new tab)
- Why can't a Login Type list view tell apart logins through two different SAML settings?
- When should a failed SAML login go to the identity provider with validator output?
- When is the Test-Only Initialization URL the right tool?
- What does Delegated Authentication Error History show?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (7 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams