For the past couple months our team has been working to enforce SSO only authentication via OKTA. We've played around with a couple ideas ranging from delegated authentication, federated authentication, etc.

We set up okta via federated authentication but want to disable direct login via user name and password. We would be doing this by removing the 'Login Form' from the 'Authentication Service' via Setup > My Domain. However, upon testing I realized that removing 'Login Form' prevents a user from going to the custom domain login screen unless you append /?login to the URL. I was under the assumption that it would just remove the username and password fields, forcing the user to select a different authentication service (OKTA button). See screenshot: enter image description here

We want to give users the ability to see the custom 'OKTA' button, but not be able to use their user name and password, so would the next best option be re-adding 'Login Form to 'Authentication Service', then check the 'Prevent login from https://login.salesforce.com'?

1 Answer 1


You can control this scenario by leveraging the Okta auth provider that you've already configured as well as enabling (but not needing to set up) Delegated Authentication.

Per the help article on the topic: https://help.salesforce.com/articleView?id=sso_tips.htm&type=5

SSO Login Settings Tips

When you configure users with an authentication provider for SSO, you can require them to log in only through the authentication provider. To prevent users from logging in with a Salesforce username and password, assign these users or a profile of these users the Is Single Sign-On Enabled user permission. If the Is Single Sign-On Enabled permission isn’t available, ask Salesforce Support to enable the delegated authentication feature. You’re not required to configure delegated authentication, but it must be enabled.

Related past question: https://salesforce.stackexchange.com/a/2002/660

  • So I don't have to enable 'Prevent login from login.salesforce.com'? Also, will said solution apply to both login.salesforce.com AND <customdomain>.my.salesforce.com? Thank you
    – Nivi
    Jan 27, 2020 at 23:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .