---
schema_version: "1"
id: 2118de28ddf9bc6d6a2fd5cf26e70c51724276b36e6da62c9f4129b2e6768f84
title: Best Practices and Additional Information for Anomalous Logins
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_detection_login_anomaly_best_practices.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_detection_login_anomaly_best_practices.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 70f3b4e7a5a7978539bc651f8d7c382fef78fe8efdde60ba04fbe17f260f5aaf
description: Understanding the nature of anomalous logins and available resources can help you manage and respond to these events effectively.
products:
  - Salesforce Platform
  - Cross Cloud
release: "264"
---
# Best Practices and Additional Information for Anomalous Logins

Understanding the nature of anomalous logins and available resources can help you manage and respond to these events effectively.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in both Salesforce Classic (not available in all orgs) and Lightning
            Experience.</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions</p>
            <p style="margin-bottom:0;">Requires Salesforce Shield or Salesforce Event Monitoring add-on
              subscriptions.</p>
          </td>

        </tr>
      </tbody>
    </table>

A login is considered anomalous when its characteristics (IP address, browser agent, location, etc.) significantly deviate from the user's established baseline of typical logins over the past 90 days. Machine learning models create a profile for each user based on their login history. Incoming logins are compared against this baseline, and an alert is triggered when a significant deviation exceeds a defined threshold. If no response is received for the email notification about this event, the system will assume it was a false positive, and the user will not receive the same notification for the same endpoint (IP, Browser, UserId combination) within a 30-day window.

Salesforce continuously monitors login activity for various suspicious patterns, including credential stuffing and brute-force attacks. Successful logins from suspicious clients trigger mitigating actions like identity challenges and forced password resets. Practicing good password hygiene, never sharing credentials, and enabling multi-factor authentication (MFA) are crucial steps to prevent unauthorized access.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-setup-264-0-0-production-enus/6f21df35-9ea0-4f53-ac94-45c3b5dfd5bc/images/icon_note.png)

Note The anomalous login score is currently computed only for non-SSO logins. SSO logins with MFA are considered less susceptible to these types of attacks.