- Welcome.
I'm Mat Hamlin,
Senior Director of Product Management
for Salesforce Identity.
I hope everyone's staying safe, happy and healthy out there.
Today I'm going to talk to you about
protecting your Salesforce environment
with multi-factor authentication.
Multi-factor authentication is a quick way
to increase the trust that you have
in the users who are logging into your Salesforce org.
Today I'll be taking you through the steps needed
to understand who's using multi-factor authentication,
how to set it up,
and the user experience
for enrolling a Salesforce authenticator.
Let's get started.
In your organization,
as you start considering
to roll out multi-factor authentication to your user base,
the best way to start any journey
is to understand where you're starting from.
So I'm going to go over a few ways for you to understand
the current position that you're in,
in regards to multi-factor authentication.
First and foremost, starting with looking at your users
to see if anyone has enrolled
with any multi-factor authentication methods.
So, I'm logging into Salesforce here
as an administrator.
I'm going to go to Setup.
Go to Users.
I'm going to create just a custom list for you
that will show the different multi-factor authentication
methods that each user has registered in.
So I'll create new view.
We'll call it MFA users.
I'm going to leave the existing selected fields
and I'm going to go ahead
and add in these at the bottom here, okay?
So we'll add those across.
I'm going to leave this as visible to me for now
and hit save.
So what that does is gives you a nice custom list view,
inside of your Users page,
where you can see all of your users
and then what types of verification methods
that they have currently enrolled.
You can also from here, disconnect if you needed to do that,
or generate a temporary token
in case somebody needs to log in
and doesn't have their phone with them.
Alright, so now that we have a good idea
of what verification methods
all the users in your organization have,
how can we take a look at if they are using them?
So in Setup, we'll move away from the users page
and we'll go to Identity Verification.
ID Verification and History report will show you
every time a user was verified
with multi-factor authentication.
So it's similar to login history
in that login history shows every login.
This will show you every verification.
It'll show you who was verified,
why they were verified, so, the activity.
What triggered it, what method was used,
whether it was a security key, or a text message,
or Salesforce Authenticator.
Okay, to quickly recap.
We've looked at what users in your org
have multi-factor authentication methods enrolled
by creating a custom list view.
We just reviewed the ID verification history report,
which shows every time a user is verified,
why they were verified, and what method that they used.
Now let's go ahead and set up multi-factor authentication
using a permission set.
To do that, we're going to create a new permission set.
So I'll just go to Permission Sets.
Say New.
I'll call this Require MFA.
And I'll leave the license set to now,
which means that this permission set
can be assigned to any user type or user license.
So in this Permission Set, we need to include
the permission that requires users to log in
with two-factor authentication, multi-factor authentication.
So I clicked Edit, and we'll scroll down to
the two-factor.
So here.
So, Two-Factor Authentication for User Interface Logins,
we'll check that.
You can also specify to set two-factor authentication
for API logins.
We encourage you to do this, but you need to make sure
that you don't have any API connections
that that might get in the way of.
So for now, I'll just click it on User Interface Logins.
Scroll back to the top and hit Save.
See your confirmation screen just asking us,
confirming what changes we made to this permission set,
and click Save.
Alright, now that we have the permission set created,
let's assign it to a user.
I'll click on Manage Assignments.
And click Add Assignments.
When you first are testing out multi-factor authentication,
just getting used to it,
I'd definitely suggest assigning it to a single user,
a test user, just so you can get a good understanding
of how it's going to work and behave when that user logs in.
I also suggest don't use your own account,
the system administrator account, as the first one to test,
just in case there are certain scenarios
you might lock yourself out.
So in this case, I'm going to select just one user here,
we'll pick Asha, and assign that.
And click Done to confirm.
Alright, so now we've set up a permission set
that requires users who have that permission set
to login with two-factor authentication.
We've assigned it to Asha.
So now let's login as Asha
and see what her user experience will be.
Okay, let's login.
Okay, so you can see what just happened was,
Asha logged in for the first time,
after she has been designated
to require multi-factor authentication.
Since Salesforce recognized
that she didn't have any multi-factor authentication methods
currently enrolled or currently registered,
it immediately pushed her into an enrollment flow
so she can connect Salesforce Authenticator to her account.
So as you can see, Asha's being directed
to download Salesforce Authenticator from the App Store
or Google Play Store.
And then in the app, tap add to connect your account.
Okay.
And so I have Authenticator freshly installed on her phone
so I will click on Add an Account.
And you can see what happens is
it generates a two-word phrase.
This two-word phrase is what we're going to use
to connect this account to the Authenticator.
So it's a temporary two-word phrase,
it's just something that can be easily remembered
and typed in.
So we're connected.
Oops, not that easily remembered.
Okay, now you can see it's prompting me
to look at my phone to complete the enrollment,
so let's look at that.
So, on the phone, this is what we see.
So Asha's being asked to connect
the Salesforce Authenticator app to her Salesforce account.
So we'll go ahead and click Connect.
And it's now added.
So we can use that for authenticating.
Just go ahead and logs in.
Thank you so much today for attending this quick session
on getting started with multi-factor authentication.
Have a great week.