3

We have Okta setup as a SSO provider for Salesforce. We want to restrict all non-Administrators from logging in with their Salesforce Username and Password. However, we still want Administrators to be able to login with their username and password.

According to this Salesforce article, this is what I need to do to force users to login through Okta:

https://help.salesforce.com/s/articleView?id=sf.sso_enforce_sso_login.htm&type=5

However, I'm a little hesitant to click the "Disable login with Salesforce credentials" option under the Delegated Authentication section. No where does it say, that I can see at least, that this only applies to non-Administrator profiles only. I'm concerned that if I click this option, all administrators as well as standard users will be required to login in through Okta. If this is not the case, the name is very misleading.

Will enabling the "Disable login with Salesforce credentials" prevent System Administrators from logging in with their Salesforce Username and Password?

Improve this question

1 Answer 1

Reset to default
4

It is recommended to allow system administrator users to login with both the authentication methods. To achieve this, kindly disable login policy 'Prevent login from https://login.salesforce.com' in your org under Policies section.

Enable delegated authentication and below are steps.

Setup--> Quick Find, search for Single Sign-On and select Single Sign-On Settings. Under Delegated authentication, select 'Disable login with Salesforce credentials'.

Disable login with Salesforce credentials will only impact SSO users with 'Is Single Sign-On Enabled' permission enabled and will only allow them to access Salesforce via SSO.

Make sure you do not enable 'Is Single Sign-On Enabled' permission for the System Admin and efficient way would be assigning above permission to non-admin users using permission set.

Also, check FAQs for Single Sign-On along with details here.

Note: Please make above changes in lower instance and do good smoke testing.

Improve this answer
1
  • Than you confirming this.
    – Swisher Sweet
    Commented Mar 7, 2023 at 2:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .