--- schema_version: "1" id: 419c75c1cc0e29c6957ac363745fbb7663cb0abf9379a37ca563c5817f7354c4 title: Preserve Login Access During a My Domain Login URL Change collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/domain_name_login_change_preserve_access.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.domain_name_login_change_preserve_access.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 8a4fc7b5f8fc29ca839dddc5e3b7cb8685c760c769e36b4552df8750d1c9e4f7 description: "When your My Domain or site login URL changes, two multi-factor authentication (MFA) verification methods stop working: built-in authenticators and security keys. Without those methods, single sign-on (SSO) can also stop working. To preserve admin access to Salesforce and prevent end-user frustration, verify your backup authentication methods. In preparation for your My Domain change, determine the post-deployment steps to reestablish authentication for your org, including resetting the affected verification methods for your users." products: - Salesforce Platform - Cross Cloud release: "264" --- # Preserve Login Access During a My Domain Login URL Change When your My Domain or site login URL changes, two multi-factor authentication (MFA) verification methods stop working: built-in authenticators and security keys. Without those methods, single sign-on (SSO) can also stop working. To preserve admin access to Salesforce and prevent end-user frustration, verify your backup authentication methods. In preparation for your My Domain change, determine the post-deployment steps to reestablish authentication for your org, including resetting the affected verification methods for your users. ### Required Editions
Available in: both Salesforce Classic and Lightning Experience
Available in: Group, Essentials, Professional, Enterprise, Performance, Unlimited, and Developer Editions
If you make one of these changes, your My Domain login URL changes and authentication methods can fail. - Renaming your My Domain. - Changing your My Domain suffix. - Sandboxes only: deploying enhanced domains. - Deploying a change that enables or disables partitioned domains in a Developer Edition org, scratch org, patch org, demo org, free org, or Trailhead Playground. If you make one of these changes, your Experience Cloud site or Salesforce Site URL changes and authentication methods for your site can fail. - Deploying enhanced domains. - Renaming your My Domain in an org with enhanced domains. - Deploying a change that enables or disables partitioned domains in a Developer Edition org, scratch org, patch org, demo org, free org, or Trailhead Playground. Authentication against your site login URL is affected only if you use the system-managed site URL to authenticate. System-managed site URLs end in \*.my.site.com for Experience Cloud sites and \*.my.salesforce-sites.com for Salesforce Sites. If you authenticate via a custom domain, such as https://www.example.com, that serves your Experience Cloud site or Salesforce Site, then the corresponding SSO configuration and MFA verification methods are unaffected. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_note.png) Note A change to your My Domain login URL or site URL requires updates to your org beyond authentication methods and settings. For details, see [Update Your Org for My Domain Changes](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_guidelines.htm&release=264.0.0&type=5 "When you deploy a change your My Domain, your Salesforce org’s login URL and application URLs change. URLs that are dynamically constructed—for example, URLs generated via the DomainCreator Apex class—use the new URLs automatically. However, some Salesforce functionality requires an update to work with your new URLs. Similarly, custom code, your network configuration, and third-party integrations that use the old URLs require updates. To ensure a smooth transition to your new URLs, update references to your old URLs."). ## Note Your Configured Authentication Methods and Review Post-Deployment Steps You can configure your My Domain or site login page to allow users to authenticate through third parties, such as Google. Before you deploy the change to your My Domain, visit the corresponding login pages and note the available options. We also recommend that you review the Authentication Settings on the My Domain Setup page. Note the selected settings and plan to update the corresponding authentication methods after you deploy your new My Domain. After you deploy the change, verify that the login page settings are correct with the new URL. For more information on updating authentication after a My Domain change that affects your login URLs, see [Update Authentication After a My Domain Change](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_auth_update.htm&release=264.0.0&type=5 "Determine whether your My Domain change requires that you update your authentication settings. Then learn about the authentication settings that can be impacted after a My Domain change and make the required updates. If your My Domain login host name or sites host name changed when you deployed a My Domain change, update your authentication settings."). When you review this section before you deploy a My Domain change, you can gather the list of updates to make before users and third parties access your updated org. ## Instruct Admins to Verify Their Backup Authentication Method Before you deploy one of these changes that affects your My Domain login URL, make sure that your admins can log in without authentication features such as SSO or security keys. For example, they can authenticate via a username and password, with a second factor of Salesforce Authenticator. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_important.png) Important Ensure that at least one admin registers Salesforce Authenticator or a third-party authenticator app as a backup method before you deploy a change to your My Domain login URL. Otherwise the admin can’t log in and help reset authentication settings or other users’ verification methods after the new My Domain is deployed. If your admins previously registered Salesforce Authenticator or a third-party authenticator app as a backup method, instruct them to verify that authentication method before you deploy the change. ## Help Users Restore Built-In Authenticator and Security Key Verification Methods When your My Domain login URL or site URL changes, two multi-factor authentication (MFA) verification methods stop working: built-in authenticators and security keys. If any of your users only use these methods to authenticate when they log in to Salesforce, they can’t log in after the login URL changes. ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_tip.png) Tip Not sure who in your org has registered built-in authenticators or security keys for MFA logins? Create a custom list view of users or review the Identity Verification Methods report. For more information, see [See How Your Users Verify Their Identity](https://help.salesforce.com/s/articleView?id=xcloud.security_monitor_verification_methods.htm&type=5&language=en_US). To learn more about built-in authenticators or security keys, see [Verification Methods for Multi-Factor Authentication](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods.htm&type=5&language=en_US). Make it easy for these users to restore their authentication methods after the My Domain change. - Before the scheduled deployment of your My Domain change, instruct affected users to register Salesforce Authenticator or a third-party authenticator app as a backup verification method. These types of verification methods aren't affected by My Domain changes. This approach allows your users to restore their original verification methods at their convenience. It can reduce support tickets related to logging in to Salesforce after the My Domain change. Also, if a user loses a device or security key, a backup verification method can preserve their access. For more information, see [Connect Your Salesforce Account to Salesforce Authenticator](https://help.salesforce.com/s/articleView?id=xcloud.salesforce_authenticator_add_account.htm&type=5&language=en_US) or [Verify Your Identity with a TOTP Authenticator App](https://help.salesforce.com/s/articleView?id=xcloud.add_time-based_token.htm&type=5&language=en_US). - As part of your communication for the My Domain change, let users know that they can re-register their built-in authenticator or security key when they log in after the change. - When you make updates to your org after you deploy the My Domain change, disconnect the built-in authenticator and security key verification methods for all users in Setup. After you disconnect the methods, users can reconfigure the verification methods. If one of the affected users didn’t register a backup method before the change, this step is required the first time that they log in to Salesforce with the new login URL. For more information on that process, see [Disconnect a User’s Verification Method](https://help.salesforce.com/s/articleView?id=xcloud.security_disconnect_verification_methods.htm&type=5&language=en_US). You can also disconnect security keys for all users through the `UserManagement.deregisterVerificationMethod()` Apex method. #### See Also - [My Domain](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_overview.htm&release=264.0.0&type=5 "Showcase your company’s brand with a customer-specific subdomain name in your Salesforce org URLs. With My Domain, you can include your company name in your URLs, for example, https://mycompany.my.salesforce.com. With these org-specific URLs, you can set up a custom login page, set a custom login policy, offer single sign-on, and allow users to log in with a social account. My Domain also allows you to work in multiple Salesforce orgs in the same browser at the same time.") - [Update Authentication After a My Domain Change](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_auth_update.htm&release=264.0.0&type=5 "Determine whether your My Domain change requires that you update your authentication settings. Then learn about the authentication settings that can be impacted after a My Domain change and make the required updates. If your My Domain login host name or sites host name changed when you deployed a My Domain change, update your authentication settings.") - [Multi-Factor Authentication](https://help.salesforce.com/s/articleView?id=xcloud.security_overview_2fa.htm&type=5&language=en_US) - [_Apex Reference Guide_: UserManagement.deregisterVerificationMethod()](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_System_UserManagement.htm#apex_System_UserManagement_deregisterVerificationMethod)