Identity verification and device activation
Key Takeaway
A login with a strong authentication method always skips device activation. Without one, Salesforce looks at the IP ranges and at whether it recognizes the browser to decide whether to challenge the login.
Identity verification is when a user gives extra evidence, called a verification method, to prove they are the true owner of an account. Salesforce uses it in three ways: multi-factor authentication (MFA) at login, device activation for login attempts it can't trust, and step-up authentication before sensitive resources. Device activation protects an org by deciding which unfamiliar logins to challenge. The decision depends on how strong the login is, whether Salesforce recognizes the browser, and how the IP ranges are set up.
Authentication and identity verification
User authentication and identity verification work together. Authentication asks users to establish who they are with credentials, such as a username and password. Identity verification asks them to prove they own the account with evidence, such as a verification code that only the user knows.
Identity verification takes three forms, and they differ in when users have to verify.
| When users verify | |
|---|---|
| Multi-factor authentication (MFA) | At login, with a verification method in addition to their username and password |
| Device activation | When logging in from an unrecognized device |
| Step-up authentication | Before an action that needs a higher session security level |
For example, step-up authentication applies when a user with a standard session opens a resource that requires a high-assurance session.