What Needs to Happen: When a user logs into the org, we perceive the attempt as either Successful (correct password), Failed (incorrect password), or Other. If the user fails the login attempt, a User object field 'Failed Attempt Counter' is increased by 1. Once the counter reaches 3, an email is sent.

The Problem: The process above has been created using a Flow/Process Builder, however, since Login Flows are only invoked post-authentication, the Flow only every updates when their is a Successful login attempt. I can call the Flow I've created if I can find a way to invoke it every time a User attempts to log in, but I can't call LoginHistory from a trigger, and the Flow won't start until their is a Successful login attempt.

Question: How do I invoke Apex/Flow/Process Builder Flow whenever someone logs in? Is there a better solution?

The Flow in case you are interested (though not necessary to answer my question): Flow

  • is it password reset mail you send when that counter reaches 3? Nov 15, 2018 at 18:47
  • @Pranay, it is not. The email is sent to Security to alert them of the numerous failed attempts.
    – paulK
    Nov 15, 2018 at 18:48
  • if you know we can lock user after some password attempts.. we can also configure that except admin none can unlock the usert Nov 15, 2018 at 18:52
  • @pranay, if I'm understanding you correctly, you are saying we should look at the locked user field that is updated on LoginHistory object when a user is locked out and trigger the event from there. Unfortunately, you can't call from Apex.
    – paulK
    Nov 15, 2018 at 18:57
  • @PranayJaiswal and you cannot invoke a flow unless you use Process Builder and Process Builder doesn't have access to the Login History object...
    – paulK
    Nov 15, 2018 at 18:58

1 Answer 1


You cannot run a process builder/trigger/workflow without logging in.

The best you do is with invalid password then lockout the user. Set the lockout effective period to forever, then show a locked user a page asking them to email the admin/security team. By this way, the security team will always know whats going on with users.

enter image description here

Another Approach will be to schedule a Scheduler every 30mins to 1 hour.

The scheduler will query LoginHistory table for LoginTime=Today

SELECT ApiType,ApiVersion,Application,AuthenticationServiceId,Browser,CipherSuite,ClientVersion,CountryIso,Id,LoginGeoId,LoginTime,LoginType,LoginUrl,NetworkId,Platform,SourceIp,Status,TlsProtocol,UserId FROM LoginHistory where LoginTime=Today

Then iterate over the records to find a record where status='Invalid Password' (You cannot use status field as filter on query for LoginHistory)

Once found gather it, make a set and then send an aggegate email to the System's team

  • Thanks for the information. I'm aware of this option, but it is not a solution. Here Salesforce provides some information on handling login exceptions and make it seem that what I'm talking about is possibe, but there is little detail on triggering this and where: help.salesforce.com/articleView?id=000212767&type=1
    – paulK
    Nov 15, 2018 at 19:26
  • @paulK i have updated my answer to include use of Login History Scheduler. Nov 15, 2018 at 19:27
  • Ok that is an interesting idea. I know they have scheduler limits that are 250k so this might work. However, it does seem like just running code for no reason. Not very efficient. Crazy there isn't a solution for this from Salesforce.
    – paulK
    Nov 15, 2018 at 19:30
  • 1
    Ok. I'm going to meet with a couple other experts today about this. If no better solution, I'll mark yours as the best. Thanks again, Pranay!
    – paulK
    Nov 15, 2018 at 20:13
  • 1
    Hey @Pranay I haven't forgotten about you. Expecting to hear back this week. Will update when I have an answer from their team.
    – paulK
    Nov 19, 2018 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .