Login Flows

Login Flows is a Setup feature that allows administrators to associate Flows with the login process, executing custom business logic after a user authenticates but before they access Salesforce. Login Flows can collect additional information, enforce custom security checks, or route users to specific pages based on their profile or IP address.

Authentication is the most reliable trigger in the platform - every user hits it, exactly once per session, no exceptions. Login Flows uses that fact. Associate a Flow with a profile, and Salesforce runs that Flow after authentication but before the user reaches their home screen. Use it to enforce custom MFA logic, accept just-updated terms of service, route users by IP or geography, prompt for missing user-record fields, or anything else that needs to run reliably at session start.

The trade-off is that any Flow you put here delays login by at least the flow's runtime, and a broken flow can lock users out of the org until you disable it. Build Login Flows defensively: timeout-tolerant, error-handled, fail-open for the cases where blocking login is worse than skipping the check. Test on a non-admin profile in a sandbox before any production rollout.