Certified Identity and Access Management Designer

By Salesforce · Question Mode

QuestionQ17

VerifiedAccepting 3rd Party Identity in Salesforce

Universal Containers’ security team has identified report exports as a high-risk action and wants users to be signed in to Salesforce with their Active Directory (AD) credentials to perform them. For every other use of Salesforce, users must be able to use either AD credentials or Salesforce credentials.

Which solution should be recommended to prevent report exports unless the user is logged in with AD credentials, while preserving the ability to view reports when logged in with Salesforce credentials?

Explanation

SAML-authenticated sessions can be classified as High Assurance, and Salesforce can require a High Assurance session specifically when reports and dashboards are exported or printed. A user authenticated with AD through SAML can therefore export reports, while a user in a standard Salesforce-credential session can continue to view reports but is denied the export action.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!