---
schema_version: "1"
id: d833141a832b73112a2e023a7c7d7f6bc77e35b301ce935f9dc996ff6be7128f
title: View Authentication Context Class Reference (ACR) Values in the Login History and Login Events
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_acr_values.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_acr_values.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 9ea9624b829c0487cc058fb4dd512d26222ef68146f6f2144d08acbf73e00668
description: You can now use the login history and login events to see Authentication Context Class Reference (ACR) values sent by your single sign-on (SSO) identity provider. Use this information to determine whether your identity provider uses a strong or weak authentication method. SSO logins with strong ACR values can skip device activation.
products:
  - Cross Cloud
release: "262"
---
# View Authentication Context Class Reference (ACR) Values in the Login History and Login Events

You can now use the login history and login events to see Authentication Context Class Reference (ACR) values sent by your single sign-on (SSO) identity provider. Use this information to determine whether your identity provider uses a strong or weak authentication method. SSO logins with strong ACR values can skip device activation.

**Where:** This change applies to Lightning Experience and Salesforce Classic in all editions.

**How:** Go to the Login History in Setup. Create a view that includes the new Authentication Context Class Reference column (1).

![Login History with the new Authentication Context Class Reference column highlighted](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/salesforce_release_notes/images/security_acr_login_history.png)

For OpenID Connect SSO, this column contains the value of the `acr` claim in the ID token. In this example, the value is `urn:okta:loa:1fa:any` (2).

```
{
  "sub": "XYZ...",
  "name": "Admin User",
  "email": "companyemail@example.com",
  "ver": 1,
  "iss": "https://MyIdentityProvider.com",
  "aud": "XYZ...",
  "iat": 1775666586,
  "exp": 1775670186,
  "acr": "urn:okta:loa:1fa:any",
  "..."//additional claims omitted
}
```

For SAML SSO, this column shows you the value of the `AuthnContextClassRef` element in the SAML response. In this example SAML response excerpt, the value is `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport` (3).

```
<saml2:AuthnStatement AuthnInstant="<timestamp>" SessionIndex="XYZ...">
  <saml2:AuthnContext>
    <saml2:AuthnContextClassRef>
      urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
    </saml2:AuthnContextClassRef>
  </saml2:AuthnContext>
</saml2:AuthnStatement>
```

You can also use Event Monitoring to view ACR values in the LoginEvent and LoginEventStream objects.

#### See Also

- [New and Changed Objects](https://help.salesforce.com/s/articleView?id=release-notes.rn_api_objects.htm&release=262.0.0&type=5 "Access more data through these new and changed standard objects.")
- [_Salesforce Help_: Device Activation for Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.device_activation_orgs.htm&language=en_US)
- [_Salesforce Help_: Single Sign-On](https://help.salesforce.com/s/articleView?id=xcloud.sso_about.htm&language=en_US)