What Stays on the Profile, Health Check and Security Center
Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.
Module 5 of 5 in the shared chapter The Front Door: Logging In to Salesforce, chapter 2 of Securing Salesforce: Sharing and Visibility and part of the Identity and Access course. Each module stands on its own.
The question this module answers: Where do the front door’s settings live, how do you check that the door is set well, and what changed at the door in 2025 and 2026?
The last four modules set up the front door: who you are, from where, when, for how long, and for which kind of user. Two questions are left. Where do all those settings live? And once they’re set, how do you know the door is still set well next month?
The profile keeps the door; permission sets carry the keys
Section titled “The profile keeps the door; permission sets carry the keys”When you open a profile and a permission set side by side, a lot of it looks the same. But not everything. The session settings, the password policies, the login hours and the login IP ranges are kept exclusive to the profile. You won’t find them on a permission set.
Here’s the rule of thumb I use to remember which goes where. Something you can have many of will probably end up on a permission set. Something you can only have one of will probably be on the profile. You can have many permission sets, so they carry the keys: access to objects, fields, apps and tabs, and permissions like the one that requires MFA for screen logins. You have only one profile, so it holds the things that can only have one answer for a user: one password policy, one session timeout, one set of login hours, one set of login IP ranges, one default app.
Salesforce’s guidance draws the same line. After cancelling its plan to retire permissions on profiles, it recommends “a least-privilege model using profiles for baseline settings and permission sets for access control.” On the profile: default apps, default record types and page layouts, login hours, login IP ranges, password policies and session settings. In permission sets and permission set groups: object permissions, field-level security, user permissions and the rest of the access (Permissions in Profiles Retirement Cancelled (opens in a new tab), Salesforce Help, published 2026-06-06, checked 2026-11-01).
That’s why every module in this chapter kept saying “on the profile.” The door is set per profile, and chapter 3 of this course goes deep on profiles, permission sets and permission set groups.
Health Check: is the door still set well?
Section titled “Health Check: is the door still set well?”Settings drift. Someone loosens a password rule to fix a complaint, someone lengthens a session timeout for a demo, and nobody changes it back. So you need a way to check the door, not just set it.
That’s Health Check, in Setup. In Salesforce’s words, “you can use Health Check to identify and fix potential vulnerabilities in your security settings, all from a single page.” It compares your settings with a baseline, either the Salesforce Baseline Standard or one of up to five custom baselines you upload, and gives you a score and a grade. Its settings are sorted into high-risk, medium-risk, low-risk and informational ones, and Fix Risks can change settings to the baseline’s values without leaving the page. Salesforce also adds new checks from time to time, so the score can change even when you haven’t (Security Health Check (opens in a new tab), Salesforce Help, checked 2026-11-01).
It also watches for you now. Since 15 April 2026, Health Check notifications are on by default for System Administrators in production orgs: a weekly alert if your score goes down (Stay Secure with Proactive Health Check Notifications (opens in a new tab), Salesforce Spring ‘26 release notes, checked 2026-11-01). Don’t turn them off. A score that drops on a Tuesday is a door someone opened on a Monday.
A word of judgment, though: a high score isn’t the goal. The baseline is Salesforce’s general recommendation. A custom baseline that matches your company’s own policy, and a score you understand, are worth more than a perfect number.
Who came through the door: Login History
Section titled “Who came through the door: Login History”Health Check tells you how the door is set. Login History, in Setup, tells you who actually came through it, when, from where and how. Since the MFA rollout, you can add columns for the strength signals an identity provider sends, the same ones module 2 described, so you can see whether single sign-on logins are arriving as strong as you think. The same values are in Event Monitoring’s login events (Prepare for MFA Enforcement for All Employee Users (opens in a new tab), Salesforce Help, checked 2026-11-01). Chapter 19 of this course covers monitoring in depth.
Many orgs: Security Center
Section titled “Many orgs: Security Center”If a company has many orgs, checking each door one by one doesn’t scale. Security Center “offers a single view of your security, privacy, and governance posture across all of your Salesforce orgs and tenants”: Health Check scores, access settings, and user and login metrics in one place. It’s an add-on, available in Enterprise and Unlimited Editions with the Security Center license, and free in Developer Edition (Take Charge of Your Security Goals with Security Center (opens in a new tab), Salesforce Help, checked 2026-11-01). If you’re the architect for a company with ten orgs, it’s worth the conversation.
What changed at the door, 2025–2026
Section titled “What changed at the door, 2025–2026”The door has changed more in the last year than in the five before it. Here’s the summary, each change dated and covered in this chapter. Dates are Salesforce’s, and some rolled out by release group over several weeks, so check what applies to your org.
| When | What changed at the door | Where |
|---|---|---|
| From 20 November 2025; API from 24 April 2026 | Connections from anonymizing VPNs, proxies and high-risk IP addresses blocked; API and connected app traffic from them freezes the user and revokes refresh tokens | Module 3 |
| Spring ‘26 | New connected apps can’t be created without a request to Salesforce Support; External Client Apps replace them | Module 1 |
| 15 April 2026 | Health Check notifications on by default for System Administrators in production orgs | This module |
| From 1 July 2026 (production, staggered) | Step-up authentication to view and export reports | Module 2 |
| From 20 July 2026 (production, by release group; some orgs extended) | MFA for every employee login, including single sign-on; phishing-resistant MFA (passkeys) for privileged users; the username-first login page | Module 2 |
| Summer ‘26 release update, enforced in Winter ‘27 | Profile filtering on by default; View All Profiles needed to see other profiles and to build login flows | Chapter 1, module 4; module 4 |
| From 4 November 2026 (production, rolling) | Idle OAuth refresh tokens expire after 30 days | Module 1 |
The pattern is the same one chapter 1 described for the whole platform: the defaults are moving toward closed. Salesforce now publishes its roadmap of these controls in one place, with a change log, so that’s the page to watch (Security-Related Product Updates to the Salesforce Platform (opens in a new tab), Salesforce Help, published 2026-09-08, checked 2026-11-01).
What an architect decides here
Section titled “What an architect decides here”- Which door settings each profile carries, and that access lives in permission sets, not on the profile.
- Which baseline Health Check measures against, the Salesforce Baseline Standard or the company’s own, and who reads the weekly notifications.
- Who reviews Login History, and how often, especially for privileged users and single sign-on.
- Whether a company with many orgs needs Security Center to see all its doors at once.
- How the team hears about the next change at the door before it’s enforced.
Beyond the exam: what AI changes. Setup with Agentforce can now help an admin review the Health Check score, Salesforce notes. That’s useful, and it’s also a reminder of this course’s first lesson: a tool can tell you what a setting is, but an architect still decides what it should be, and why.
Explore
Section titled “Explore”- Permissions in Profiles Retirement Cancelled (opens in a new tab), Salesforce Help (checked 2026-11-01)
- Security Health Check (opens in a new tab), Salesforce Help (checked 2026-11-01)
- Stay Secure with Proactive Health Check Notifications (opens in a new tab), Salesforce Spring ‘26 release notes (checked 2026-11-01)
- Take Charge of Your Security Goals with Security Center (opens in a new tab), Salesforce Help (checked 2026-11-01)
- Security-Related Product Updates to the Salesforce Platform (opens in a new tab), Salesforce Help (checked 2026-11-01)
- Prepare for MFA Enforcement for All Employee Users (opens in a new tab), Salesforce Help (checked 2026-11-01)