Password-free login options for internal users
Key Takeaway
You can limit Lightning Login to users with the Lightning Login User permission, but you can't disable passkeys for specific users. After passkeys are allowed, every internal user with a saved username and a registered built-in authenticator or security key can log in with one.
Salesforce gives internal users (employees) three ways to log in without typing a password: Lightning Login, passwordless login with passkeys, and certificate-based authentication. Each one replaces the password with something harder to steal. The options differ in the device they need, which users can use them, and how much control the admin has over who gets them.
The three password-free options
Each option needs something different from the user:
- Lightning Login uses the Salesforce Authenticator mobile app.
- Passwordless login with passkeys uses a built-in authenticator, such as Touch ID or Windows Hello, or a security key.
- Certificate-based authentication uses a unique user authentication certificate (PEM-encoded X.509), such as one on a personal identification verification (PIV) card.