Has anyone fielded a request to prevent a username from logging into multiple sessions at once?

The problem is that currently Salesforce does not have declarative way of preventing logins, of the same username, from multiple sessions. The idea of checking a username out and back in when it is in an active session would help curve, but not eliminate, folks sharing usernames and passwords.

Has anyone discovered a workaround?

  • 1
    Can you delegate this problem to a single-sign-on authentication provider? Commented Oct 30, 2012 at 17:15
  • Good question - I can only speculate that some implementation of SSO could solve this. But I hope the ultimate solution for my customers is not simply to recommend they implement SSO for the use of a single application. Commented Oct 30, 2012 at 17:26
  • Not sure about mobile, but multiple browser sessions could be curbed by having a custom landing page (with no header or sidebar), which redirects to the application only if there isnt another recent login history for the user from a different ip(check using select id, userid, LoginTime, SourceIp from loginhistory). Else redirects to display permission denied landing page Commented Oct 30, 2012 at 23:14

2 Answers 2


I'm not aware of a proactive way of doing this. However you could build a report over the login history object and look for multiple concurrent sessions from different IP Addresses.

However if you have users that access Salesforce via the API or using the mobile apps then there may well be valid reasons why they appear to have multiple concurrent sessions. The source of the login should be indicated in the report to help identify these scenarios.

You could use the 'Users Logged in This Week' standard administrative report as a starting point

  • The issue is not really logging in from multiple IP addresses - it is more about being logged in concurrently. e.g. I am logged into my mobile device therefore I cannot be logged into my desktop or visa-versa. Commented Oct 30, 2012 at 16:37
  • Assuming that the mobile device and desktop access the internet via a separate network and therefore present a different IP address this would distinguish between them. If they both accessed via the same IP then you could distinguish it using the Client Type field on the login history. Commented Oct 30, 2012 at 16:40
  • Yeah this would be an acceptable measure for an audit, but as you said, not proactive. This may not fly for IT security teams in highly regulated industries. Thanks Commented Oct 30, 2012 at 16:45

A sample Implementation using Login Flow is provided in Salesforce Security Guide. It is also available as an unmanaged package which can be installed directly and configured.The solution essentially retrieves the number of concurrent sessions for a user. If the login attempt exceeds the concurrent session limit, the flow blocks it.

Link for the implementation - https://developer.salesforce.com/docs/atlas.en-us.232.0.securityImplGuide.meta/securityImplGuide/security_login_flow_limit_concurrent_sessions.htm

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .