Login auditing, Event Monitoring and login flows
Which tool answers which audit question during and after login: Session Management for live sessions, Identity Verification History and the methods report for MFA, Event Monitoring, Real-Time Event Monitoring, transaction security and Threat Detection for activity and attacks, and login flows for checks that run at every login.
Given a scenario, describe which tools you can apply to audit and verify the activity/user during and after login.
~6 min read · 11 practice questions ·
What the exam expects
- Match an audit question to the tool that answers it: active sessions, past logins, verification attempts, registered methods, setup changes, or actions taken after login.
- Know which tools need Salesforce Shield or the Event Monitoring add-on and which come with every org.
- Use Event Monitoring, Real-Time Event Monitoring (LoginEvent, LoginEventStream, LoginKey), transaction security policies and Threat Detection for Login As activity, session tracing, blocking and attack detection.
- Use a login flow to verify or collect data at every login, and know where it doesn't run.
Key terms: Session Management (Setup page of active sessions); Identity Verification History (log of MFA and other verification attempts); Real-Time Event Monitoring (streaming and stored events such as LoginEventStream and LoginEvent); transaction security policy (conditions on an event plus Block, Multi-Factor Authentication or Notifications); login flow (screen flow or Visualforce page run after authentication for a profile).
Key facts
- Detail
- All editions; active sessions only; Remove forces a new login
- Detail
- Immediate for most services, up to 30 minutes for some
- Detail
- Up to 20,000 attempts, past 6 months
- Detail
- Unrecognized device or new IP; risk-based authentication
- Detail
- Identity Verification Methods report or user list view
- Detail
- Shield or Event Monitoring add-on
- Detail
- Ties all events in one login session together
- Detail
- LoginEventStream streams; LoginEvent stores and drives policies
- Detail
- Session hijacking and credential stuffing support Notifications only
- Detail
- Designated login flow, associated per profile
- Detail
- Not applied to API logins
Sources for this section (8)
- Session Managementhelp.salesforce.com (opens in a new tab)
- Identity Verification Historyhelp.salesforce.com (opens in a new tab)
- Monitor and Audit Securityhelp.salesforce.com (opens in a new tab)
- Event Monitoringhelp.salesforce.com (opens in a new tab)
- LoginEventdeveloper.salesforce.com (opens in a new tab)
- Event Monitoring Considerationshelp.salesforce.com (opens in a new tab)
- Transaction Securityhelp.salesforce.com (opens in a new tab)
- Custom Login Flowshelp.salesforce.com (opens in a new tab)
- Why can't Login History end a session from an unexpected country?
- When does Identity Verification History show Device activation in Triggered By?
- Which tools need no Shield or Event Monitoring license?
- Why does a login flow reach SAML users but not Data Loader?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (11 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams