User authentication: SSO, MFA and login controls
Predict what login IP ranges, trusted IP ranges, login hours and session settings allow or block, where MFA is required or optional, and how SAML SSO, Just-in-Time provisioning, delegated authentication, authentication providers, login flows and session security levels behave.
Given a scenario, determine the implications of user authentication.
~8 min read · 17 practice questions ·
What the exam expects
- Tell a hard login block (profile login IP ranges, login hours) from a verification challenge (trusted IP ranges), and keep a block in force during a session.
- State who must use MFA, how to extend it to API and external logins, and what admins can't do for users.
- Configure SAML single sign-on, Just-in-Time provisioning and an SSO outage path for admins.
- Choose between SAML SSO, delegated authentication and an authentication provider with a registration handler.
- Predict when a login flow runs and how session security levels treat each login method.
Key terms: login IP ranges (profile addresses outside which login is denied); trusted IP ranges (org addresses that skip identity verification); Just-in-Time provisioning (creating users from a SAML assertion at first login); delegated authentication (Salesforce calls your web service to check the password); session security level (Standard or High Assurance, set by the login method).
Key facts
- Detail
- A login from any other IP address is denied
- Detail
- Checks profile ranges on each page request, not only at login
- Detail
- Outside them, users log in after a verification challenge
- Detail
- User can view the current page but take no further action
- Detail
- Required for internal users in production orgs and sandboxes
- Detail
- API Logins permission; User Interface Logins permission
- Detail
- Issuer and Entity ID
- Detail
- Applies only to users with Is Single Sign-On Enabled
- Detail
- The external service enforces password policies
- Detail
- Login flows can't be applied to API logins
- Detail
- Multi-factor authentication only
Sources for this section (9)
- Restrict Login IP Addresses in Profileshelp.salesforce.com (opens in a new tab)
- Set Trusted IP Ranges for Your Orghelp.salesforce.com (opens in a new tab)
- Control Access to the Orgtrailhead.salesforce.com (opens in a new tab)
- MFA for Direct Salesforce Loginshelp.salesforce.com (opens in a new tab)
- Step 2: Create a SAML SSO Settinghelp.salesforce.com (opens in a new tab)
- Require Users to Log In with SSOhelp.salesforce.com (opens in a new tab)
- Delegated Authenticationhelp.salesforce.com (opens in a new tab)
- Custom Login Flowshelp.salesforce.com (opens in a new tab)
- Modify Session Security Settingshelp.salesforce.com (opens in a new tab)
- Why doesn't adding a network to trusted IP ranges stop logins from other networks?
- When does a login flow run, and when doesn't it?
- What creates users at first login with an authentication provider such as Google?
- When would you choose delegated authentication over SAML SSO?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Administrator II pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 29 lessons of the Platform Administrator II guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (17 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams