---
schema_version: "1"
id: 5b2d1c0e4b41beeb05c55c6061bfa3e1e3ed8c321bb5798b3f13a11ae5399b4d
title: User Authentication for B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_user_authentication.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_user_authentication.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 6c7af4abe15f0ffa8f0ad54f19d1b02ddd85c38fcdc18b6924ef50084595bb4f
description: Always use unified authentication in Salesforce B2C Commerce if you’re an administrator. Traditionally, we always used local user authentication, but a local user can perform only a local login into the Business Manager instance on which their credentials were created. After a site migrates to unified authentication, the site requires unified authentication on Account Manager, where a user can perform a global login into any Business Manager instance in their organization.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# User Authentication for B2C Commerce

Always use unified authentication in Salesforce B2C Commerce if you’re an administrator. Traditionally, we always used local user authentication, but a local user can perform only a local login into the Business Manager instance on which their credentials were created. After a site migrates to unified authentication, the site requires unified authentication on Account Manager, where a user can perform a global login into any Business Manager instance in their organization.

## Local Authentication

For local user authentication, an admin, or an existing user with appropriate permissions, provisions a new user in Business Manager, and stores the user’s credentials on the instance. If you want a user to log in to several instances, you must create an account for them on each instance. The primary security controls relate to user password policy and login lockout policy. These settings have reasonable default values that you can modify depending on your policy requirements.

To enhance security, increase password length from eight characters (default) to 12 characters. Update customer lists configured prior to Release 17.5.

## Unified Authentication

Unified user authentication is where Account Manager manages all the Business Manager users in a multi-site org. Users must use their Account Manager credentials to log in to Business Manager. Account Manager handles all user-related actions, including password changes and resets. These processes ignore the corresponding Business Manager settings.

The primary security controls are the user password, login, and lockout policies. You can modify the default values depending on your policy requirements. Unlike with Business Manager, Account Manager uses two-factor authentication (2FA). This significantly improves security because an attacker now requires access to both the password and the user’s 2FA application to gain access.