2

Does the salesforce password ever expire? Any guides or documentation on the password policy? I know there it is explicitly possible to reset password, but is there any implicit expiry possibility?

  • 1
    First link from google search result: Set Password Policies, if you enter the search query as your title. I guess it has what you are looking for, otherwise please state your exact problem. – Raul Oct 3 '17 at 11:09
4

Yes, you can set a variety of parameters for your org’s password policy. In Classic or Lightning Setup, search for “Password Policies” in the quick find. The page is pretty self-explanatory - set expiration period, complexity rules, and retained passwords that cannot be reused.

More details are in this Help article: https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/admin_password.htm

3

As already mentioned by Thomas, you can specify various password expiration policies that apply to the entire org, but you can also exempt certain users from this policy by setting the Password Never Expires option on their profile or via a Permission Set. This allows you to have more control over password policies for normal users versus admins.

As far as general advice goes, various people will give you different opinions about it, but they're all simply guidelines. Choose a balanced approach, and you should be okay. Specifying complexity and length requirements, expiry times, two factor authentication, and an account lockout period is probably excessive, and is more likely to inconvenience a user than it is to stop an actual hacking attempt. Remember, the goal of security is to be safe enough to keep hackers out, but not so secure that your users never adopt the platform to begin with.

Consider requesting/enforcing two-factor authentication with no complexity or length requirements and a modest user lock out period, or perhaps simply using Lightning Login, which requires that they simply verify the login request from their phone for their registered devices. They'll still need to use their username and password from unrecognized devices as they do today, but they'll basically be able to "set it and forget it." Unauthorized users that obtain their username and password still won't be able to log in, because they'll have to verify the login within the timeout window on their mobile device.

Given the variety of newer technologies that are available, forcing users to have complicated, forgettable passwords, and lost productivity because they can't log in should be a thing of the past. Of course, you can still protect part of your org behind a "high assurance only" policy, meaning that super-secret information can only be accessed if they log in with a username, password, and Salesforce Authenticator approval.

1

In Salesforce, click Setup / Security controls / Password Policies and then you'll find the password policy configuration options.

If you need more documentation, in addition to what other answers gave you, you can click the 'Help for this page' link in the upper right corner of the page.

  • 1
    Perhaps you could expand on your answer? This only tells the OP where to go look for the settings, not anything about them. We consider this a "low quality answer". A link to some documentation would seem appropriate for the question that was asked. – crmprogdev Oct 3 '17 at 12:19
  • Sorry about that, but the question also shows very few search before asking, so I put no more efforts in my answer because I thought it was unnecessary : the question was "can you define a policy, is there doc". Once you click on "Password policies" you got the answer to the first (you can) and the link to the second (click "Help for this page" leads you to the doc). I'll put the -v option to my answer next time however... – Emmanuel BRUNO Oct 3 '17 at 12:44
  • 1
    A poor question doesn't really excuse a poor answer. – Adrian Larson Oct 3 '17 at 12:48
  • @EmmanuelBRUNO Your comments about the answers the OP would have found by clicking on the links you've mentioned are exactly the kind of useful details that I'm speaking of - explicit details to help him find the answers to his question since he apparently didn't know how to search to find them for himself. Editing your answer to include those details would have raised the level of your answer to where it likely wouldn't have been placed in the "low-quality answer" queue for review to be voted on for deletion. – crmprogdev Oct 3 '17 at 13:18
  • @AdrianLarson : I was just trying to help (which I did, someone found answer useful), I said "sorry about that", I said I will be more verbose next time... If that's not enough please don't put me on trial, if you wan't to delete my answer, please just do it. – Emmanuel BRUNO Oct 3 '17 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.