We have Federated Authentication implemented for our SSO and therefore a separate set of password policies are being applied from the client app. I found this SF article but it is only referring to Delegated Authentication, which confirms that Salesforce does not enforce anything around the password.

Just wanting to be 100% sure that the same is applied for Federated Auth. I believe so because in comparing policies between SF and the client app, SF has the stricter policy and yet log ins are permitted. If there is any documentation out there, or from your experience you can confirm, it would be appreciated.

1 Answer 1


Salesforce can't enforce password policies for Federated Authentication, because it never sees the password (or even the username!) of the user being authenticated. The authentication is handled entirely by the authentication server, which then provides Salesforce with a unique identifier for that user (the Federation ID) along with a signature that proves the veracity of the assertion, along with custom properties that may be also be sent.

  • Would've thought so but best to hear it from an expert. Thanks mate
    – Francis A.
    Dec 12, 2019 at 5:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .