Delegated Authentication Error History
Delegated Authentication Error History is the Salesforce Setup log that captures every Delegated Authentication callout failure: the timestamp, the user attempting login, the error type (endpoint unreachable, certificate invalid, timeout, validation false), and the response detail if available.
Definition
Delegated Authentication Error History is the Salesforce Setup log that captures every Delegated Authentication callout failure: the timestamp, the user attempting login, the error type (endpoint unreachable, certificate invalid, timeout, validation false), and the response detail if available. The log is the diagnostic surface for orgs running Delegated Authentication; failures here mean users could not log in, and the log is how admins reconstruct what went wrong.
Delegated Authentication Error History exists because Delegated Authentication failures are silent to the user beyond a generic login-failed message. Without the history, admins have no way to distinguish a network blip from a configuration error from an external service outage. The page surfaces the error type and timing so admins can correlate with endpoint logs, infrastructure events, or certificate expirations. For orgs migrating off Delegated Authentication, the history is also the evidence base for documenting the operational case for migration.
Why Delegated Authentication Error History is the diagnostic surface for legacy SSO failures
Where Delegated Authentication Error History lives
Setup, Security, Delegated Authentication Error History. The page lists recent failures (typically the last 21 days) with columns for username, timestamp, error type, and brief error description. Click a row to see the full error message and request context. The history is read-only; admins cannot edit or delete entries. The retention is platform-managed; older entries roll off as new ones arrive.
Error types and what each means
Common error types: Endpoint Unreachable (Salesforce could not connect to the callout URL), Certificate Invalid (the endpoint's TLS certificate failed validation), Timeout (the endpoint did not respond within the configured timeout), Validation Failed (the endpoint responded but returned false for the user's credentials), Malformed Response (the endpoint returned non-SOAP or invalid SOAP). Each type points to a different root cause; the diagnostic flow starts with reading the error type and drilling into the endpoint side from there.
Correlating with endpoint-side logs
Salesforce's view is one side of the conversation; the endpoint's view is the other. For Endpoint Unreachable and Timeout errors, the endpoint may have no record because the request never arrived. For Validation Failed errors, the endpoint should log the validation attempt with the result. Correlating both logs is how admins reconstruct what actually happened. The most reliable diagnostic pattern: identify the time window from the Error History, pull the endpoint logs for that window, look for matching requests by source IP or username.
Common failure patterns and their fixes
Five patterns recur. Spike of Endpoint Unreachable errors: endpoint outage or network issue on the customer side. Steady drip of Certificate Invalid: endpoint certificate expired or rotated to a chain Salesforce does not trust. Increasing Timeout count: endpoint is slowing under load. Sudden Validation Failed for known-good user: customer-side identity store changed (password expired on the source AD, account locked). Malformed Response after endpoint code change: customer broke the SOAP contract on a deploy. Each pattern has a different remediation on the customer side.
Using the Error History for operational alerts
Production Delegated Authentication deployments should alert on Error History activity. A Flow that queries DelegatedAuthenticationLogEntry every 15 minutes and posts to Slack or PagerDuty when failures exceed threshold gives the admin team minutes of detection time instead of hours. Alert thresholds: more than 5 Endpoint Unreachable in 5 minutes (endpoint outage), any Certificate Invalid (rare and high-impact), more than 10 percent failure rate over 1 hour (degrading health). The alerts catch issues before user complaints.
Migration-off case and the history as evidence
For orgs planning to migrate from Delegated Authentication to SAML, the Error History is operational evidence supporting the migration case. A history showing repeated endpoint outages, certificate-related blocks, or sustained validation failures is the argument for modernizing. The cumulative count of failed logins over a quarter quantifies the operational cost of staying on Delegated Authentication. Most migration business cases use the Error History data to justify the migration project budget.
Audit, compliance, and the failure-trail question
Auditors reviewing authentication posture may ask about Delegated Authentication reliability and failure handling. The Error History is the evidence. Capture per-quarter summaries: total failures, failure rate, types breakdown, mean time to remediation. The summaries become part of the SOC 2, ISO 27001, or similar attestation evidence. Even for orgs comfortable with Delegated Authentication, the history is what regulators want to see.
How to use Delegated Authentication Error History for operational health
The pattern: monitor the page weekly, alert on critical thresholds, correlate failures with endpoint logs, use the data to drive remediation or migration. The history is operational furniture; without active use, failures persist longer than they should.
- Open Delegated Authentication Error History weekly
Setup, Security, Delegated Authentication Error History. Review failure types and counts. Note trends.
- Build alerts on critical thresholds
Flow or scheduled Apex that queries DelegatedAuthenticationLogEntry and posts to Slack or PagerDuty when failures exceed threshold.
- Correlate failures with endpoint logs for diagnosis
Pull the endpoint's logs for the failure window. Match by source IP and username to reconstruct what happened.
- Document remediation per failure pattern
Endpoint outage runbook, certificate rotation runbook, timeout investigation runbook. Reusable runbooks speed response.
- Capture quarterly summaries for compliance evidence
Total failures, types breakdown, mean time to remediation. The summary supports audit evidence and migration cases.
- Use trend data to support migration planning
Repeated outages or certificate issues are the operational case for moving to SAML or OAuth.
- Retain summaries beyond the 21-day platform window if compliance requires
The platform-side history rolls off; manual extracts to a long-term log preserve the trail.
Weekly for active Delegated Authentication deployments; daily during incident response.
Per error type, per time window. Configure to balance alert fatigue against detection latency.
Matching source IP and username to reconstruct full request context.
Platform retains 21 days; long-term retention requires manual export to external log.
Quarterly for SOC 2 / ISO 27001 evidence; per-incident for specific audit requests.
- The platform retains only the last 21 days of entries. Long-term retention requires manual export.
- Endpoint-side logs are necessary to fully diagnose most failures. Without them, the Salesforce side alone is incomplete.
- Without alerts, failures linger until users complain. The page is operational furniture only when actively monitored.
- Certificate Invalid errors are rare but high-impact. Add to the cert-rotation inventory; expirations on the endpoint side are silent on the Salesforce side until they occur.
- The history is read-only. Admins cannot edit, delete, or annotate entries; correlations and remediation notes live in external runbooks.
Trust & references
Cross-checked against the following references.
- Delegated Authentication referenceSalesforce
- Salesforce security overviewSalesforce
Straight from the source - Salesforce's reference material on Delegated Authentication Error History.
- Delegated Authentication Error HistorySalesforce Help
- Delegated AuthenticationSalesforce Help
- Login HistorySalesforce Help
Hands-on resources to go deeper on Delegated Authentication Error History.
About the Author
Dipojjal Chakrabarti is a B2C Solution Architect with 29 Salesforce certifications and over 13 years in the Salesforce ecosystem. He runs salesforcedictionary.com to help admins, developers, architects, and cert/interview candidates sharpen their fundamentals. More about Dipojjal.
Test your knowledge
Q1. What is the primary benefit of Delegated Authentication Error History for Salesforce administrators?
Q2. Can a Salesforce admin configure Delegated Authentication Error History without writing code?
Q3. Why is understanding Delegated Authentication Error History important for Salesforce admins?
Discussion
Loading discussion…