How to Add Salesforce Authenticator: Your Comprehensive Guide

Adding Salesforce Authenticator is a vital step in bolstering your Salesforce security and protecting your valuable data. In essence, the process involves downloading the app, connecting it to your Salesforce account, and verifying your identity through push notifications or one-time passwords (TOTP). Let’s dive into the step-by-step process:

1. Download Salesforce Authenticator: Obtain the app from either the Apple App Store (for iOS devices) or the Google Play Store (for Android devices). Search for “Salesforce Authenticator” and install the official app.

2. Log in to Salesforce: Access your Salesforce account through a web browser.

3. Navigate to Advanced User Details: Click on your profile icon in the upper right corner and select “Settings“. In the Quick Find box, type “Advanced User Details” and click on the result.

4. Connect Salesforce Authenticator: Scroll down to the “Salesforce Authenticator” section. If you haven’t already connected an authenticator app, you will see a button labeled “Connect Salesforce Authenticator“. Click this button.

5. Generate a Two-Word Phrase: Salesforce will display a unique two-word phrase. This phrase is a crucial part of the connection process.

6. Open Salesforce Authenticator App: Launch the Salesforce Authenticator app on your mobile device.

7. Add an Account: Tap the “Add Account” button (usually a plus sign “+” icon).

8. Enter the Two-Word Phrase: The app will prompt you to enter the two-word phrase displayed on your Salesforce screen. Type the phrase accurately and tap “Connect“.

9. Verify the Connection: Salesforce Authenticator will send a push notification to your phone. The notification will display the details of the login attempt, including the service (Salesforce) and the user (your username). Tap “Approve” to finalize the connection.

10. Backup Your Account: Once connected, you’ll be prompted to create a backup of your account in the Salesforce Authenticator app. This is highly recommended as it allows you to recover your account if you lose or replace your phone. You’ll be given a unique recovery phrase. Store this phrase securely – do not share it with anyone and keep it in a safe place, separate from your phone.

11. Consider Location Services: Salesforce Authenticator uses location services to verify login requests. This helps prevent fraudulent logins from unfamiliar locations. You can choose to enable or disable location services in the app settings.

That’s it! You’ve successfully added Salesforce Authenticator to your Salesforce account. You’ll now be prompted to use the app to verify your identity whenever you log in from a new browser or device.

Frequently Asked Questions (FAQs) about Salesforce Authenticator

Let’s address some common questions regarding Salesforce Authenticator to provide a deeper understanding of its functionality and usage.

What is Multi-Factor Authentication (MFA) and why is it important?

Multi-Factor Authentication (MFA) is a security system that requires more than one method of authentication from independent categories of credentials to verify a user’s identity. This is crucial because relying on just a username and password (single-factor authentication) leaves you vulnerable to phishing attacks, password breaches, and other security threats. MFA drastically reduces the risk of unauthorized access by requiring a second factor, such as a code from Salesforce Authenticator. It’s a fundamental security best practice for protecting sensitive data.

How does Salesforce Authenticator work?

Salesforce Authenticator works as a two-factor authentication method. When you log in to Salesforce from a new browser or device, after entering your username and password, Salesforce sends a push notification to your mobile device. The notification asks you to approve or deny the login attempt. If you approve, the login is successful. If you deny, the login is blocked. Alternatively, if you have disabled push notifications, you can use a Time-Based One-Time Password (TOTP) generated by the app.

What if I don’t receive push notifications from Salesforce Authenticator?

Several factors can prevent push notifications from reaching your device. First, ensure that push notifications are enabled for the Salesforce Authenticator app in your phone’s settings. Second, check your internet connectivity – a stable Wi-Fi or cellular connection is necessary. Third, restart the Salesforce Authenticator app. If the problem persists, try re-registering the app with your Salesforce account (remove the account in Salesforce and reconnect as detailed above). Also, check if “Do Not Disturb” mode is activated on your device as this might block notifications.

What happens if I lose my phone with Salesforce Authenticator installed?

Losing your phone doesn’t necessarily mean you’re locked out of your Salesforce account. If you configured account backup and recovery when you initially set up Salesforce Authenticator, you can use your recovery phrase to restore your account on a new device. If you didn’t back up your account, you’ll need to contact your Salesforce administrator to disable Salesforce Authenticator for your account. They can then provide you with a temporary verification code or reset your MFA settings. This highlights the critical importance of backing up your account and securely storing your recovery phrase.

Can I use Salesforce Authenticator with multiple Salesforce accounts?

Yes, Salesforce Authenticator can be used with multiple Salesforce accounts. Simply repeat the account connection process for each account. The app will then display separate entries for each account, allowing you to approve or deny login requests for each one. This is incredibly useful for consultants or individuals who manage multiple Salesforce orgs.

Is Salesforce Authenticator the only MFA option available for Salesforce?

No, Salesforce offers several MFA options. Besides Salesforce Authenticator, you can use third-party authenticator apps that support TOTP (like Google Authenticator or Microsoft Authenticator), security keys (U2F or WebAuthn compliant keys), or even Salesforce’s own built-in verification methods such as temporary verification codes sent via email or SMS (although SMS is not recommended for security reasons).

How do I disconnect Salesforce Authenticator from my Salesforce account?

To disconnect Salesforce Authenticator, navigate to “Advanced User Details” in your Salesforce settings, as you did when initially connecting the app. Find the “Salesforce Authenticator” section and click the “Disconnect” button. You will be prompted to confirm the disconnection. After disconnecting, you will no longer be required to use Salesforce Authenticator for logins.

Does Salesforce Authenticator work offline?

While Salesforce Authenticator requires an internet connection to receive push notifications, it can still be used offline if you have enabled TOTP (Time-Based One-Time Password) functionality. When you log in, select the option to enter a verification code instead of approving a push notification. The app will generate a unique, time-sensitive code that you can enter into Salesforce.

What are the location services used for in Salesforce Authenticator?

Location services provide an additional layer of security. When location services are enabled, Salesforce Authenticator compares the location of the login attempt with the location of your mobile device. If the locations are significantly different, the app may flag the login as suspicious and prompt you to deny the request, even if you recognize the username and service. This helps prevent unauthorized access even if your credentials have been compromised. Enabling location services is strongly recommended for enhanced security.

How do I troubleshoot issues with the two-word phrase during setup?

The two-word phrase is case-sensitive and must be entered exactly as displayed on your Salesforce screen. Double-check for typos or spaces. If you continue to experience issues, refresh the Salesforce page to generate a new two-word phrase and try again. Ensure that your Salesforce Authenticator app is updated to the latest version.

Can I use Salesforce Authenticator on multiple devices?

While you can install Salesforce Authenticator on multiple devices, you can only actively use one device at a time for MFA. When you connect a new device, the previous device becomes inactive for authentication purposes. This is a security measure to prevent unauthorized access from multiple devices.

What happens if I change my Salesforce password?

Changing your Salesforce password does not automatically disconnect Salesforce Authenticator. The app remains connected to your account and will continue to function normally. However, it’s a good security practice to review your connected apps and devices after changing your password to ensure that everything is still authorized.

By implementing Salesforce Authenticator, you significantly enhance your Salesforce security posture and protect your organization’s sensitive data. Remember to back up your account, understand the app’s features, and troubleshoot common issues to ensure a smooth and secure authentication experience.