Loading

"Verify Account" Link in New User Welcome Email Is Redirected to Login Page

Publiceringsdatum: Jul 6, 2026
Beskrivning

If new Salesforce users have email accounts hosted on Microsoft Office 365 with Safe Links protection enabled, the "Verify Account" URL in new user welcome emails will be automatically rewritten by Microsoft's security scanning service.
When Microsoft Office 365 Safe Links scans an outbound email, it rewrites all URLs for security inspection purposes. Because the Verify Account URL is a one-time-use link, Microsoft's scan consumes it before the email reaches the user's mailbox. The link expires immediately, so when the user clicks it, they are redirected to the standard Salesforce login page — sometimes with an invalid username/password error — instead of the "Change your password" page.
The only resolution is to add the Salesforce domain to the Safe Links Allow List (also called the "Do not rewrite the following URLs" list) in Microsoft Defender for Office 365.

Lösning

Prerequisites

Before following the instructions below:

  1. Confirm the new Salesforce user is affected: copy the "Verify Account" URL from the user's mailbox and verify that it has been rewritten to a safelinks.protection.outlook.com URL.
  2. The steps below must be performed by a Microsoft Office 365 Administrator. Thorough analysis is recommended before implementation. Contact Microsoft Support if necessary.

Resolution Steps

  1. Launch the Microsoft Defender Safe Links portal with Office 365 admin credentials.
  2. Follow the steps in the Microsoft documentation to edit the appropriate Safe Links policy under Policies & rules in the Defender Admin Center.
  3. Under Protection settings, navigate to the "Do not rewrite the following URLs" section and add one of the following Salesforce domains:
    1. Option A: `<REDACTED>
    2. Option B: `<REDACTED>
  4. Save the changes.
  5. Create a new user in Salesforce and verify that the "Verify Account" URL arrives in the user's mailbox without rewrite and successfully redirects to the password change page.

Notes

  • If the same issue occurs when creating new Communities (Experience Cloud) users, add the community domain URLs to the allow list.
  • These instructions apply to new user creation emails only. Password reset emails for existing users are not affected.

Microsoft Documentation Reference

For more details on Safe Links policy configuration, see Set up Safe Links policies in Microsoft Defender for Office 365.

Knowledge-artikelnummer

000390160

 
Laddar
Salesforce Help | Article