Activations

Available in: Both Salesforce Classic and Lightning Experience

Available in: All Editions

When a user logs in from outside a trusted IP range and uses a browser or app we don’t recognize, the user is challenged to verify identity. We use the highest-priority verification method available for each user. In order of priority, the methods are:

• Verification via push notification or location-based automated verification with the Salesforce Authenticator mobile app (version 2 or later) connected to the user’s account.
• Verification via a U2F security key registered with the user’s account.
• Verification code generated by a mobile authenticator app connected to the user’s account.
• Verification code sent via SMS to the user’s verified mobile phone.
• Verification code sent via email to the user’s email address.

After identity verification is successful, the user doesn’t have to verify identity again from that browser or app, unless the user:

• Manually clears browser cookies, sets the browser to delete cookies, or browses in private or incognito mode
• Deselects Don’t ask again on the identity verification page

The Activations page in Setup lists the login IP addresses and client browser information of devices from which users have verified their identity. You can revoke the browser activation status for one, many, or all users.

For example, a user reports a lost device and is issued a new one. You can revoke the activation status of the browser on the lost device so that anyone attempting to access the org from that device has to verify their identity. This identity verification adds a layer of security while allowing users to stay productive.

Users can view their own Activations page to check their login IP addresses and client browser information. End users can revoke the activation status only for their own activated browsers.

For example, a user logs in to the org. On the user’s Activations page, several different browsers are activated, but the user has only logged in from a single browser on a work laptop. The user immediately revokes the activation status of those browsers the user doesn’t recognize. Because this user is challenged for identity verification using a code sent via SMS to the user’s mobile device, anyone else who tries to log in from one of the deactivated browsers can’t get the texted verification code. Without the code, the hacker fails the identity verification challenge. The user can then report the potential security breach.

• Use Activations
  View your users’ activations and revoke activation status to prevent security breaches.