> ## Documentation Index > Fetch the complete documentation index at: https://support.fieldko.com/llms.txt > Use this file to discover all available pages before exploring further. # Login and Security > Set up My Domain, single sign-on, multi-factor authentication, session, and connected app policies for reps who work offline. Reps log in to the FieldKo Atlas app with their Salesforce credentials, so your org's login settings apply to the app as well as to Salesforce. This page covers the settings that matter most for field teams and links to Salesforce Help for the details. ## User Permissions Needed | To do this | You need | | - | - | | Change My Domain, single sign-on, session, and IP settings | Customize Application and Manage Users | | Edit connected app policies | Customize Application | | View login history | Manage Users | ## Settings at a Glance | Setting | What to Know for FieldKo | Learn More | | - | - | - | | My Domain | If your org uses My Domain or single sign-on, give reps your My Domain login URL so the app opens your login page. | [My Domain](https://help.salesforce.com/s/articleView?id=sf.domain_name_overview.htm\&type=5), [Install the FieldKo Atlas App](/getting-started/install) | | Single sign-on | The app logs in through the Salesforce login page for your login URL, so reps see the same single sign-on options as in a browser. | [Single Sign-On](https://help.salesforce.com/s/articleView?id=sf.sso_about.htm\&type=5) | | Multi-factor authentication | Salesforce requires multi-factor authentication for users who log in to Salesforce directly. Reps who log in to the app with a username and password complete the same verification. With single sign-on, your identity provider can handle it. | [Multi-Factor Authentication](https://help.salesforce.com/s/articleView?id=sf.security_overview_2fa.htm\&type=5) | | Session settings | Session timeout ends browser sessions. The app renews its session in the background with a refresh token, so reps aren't logged out of the app when a browser session would time out. | [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=sf.admin_sessions.htm\&type=5) | | Connected app policies | The **FieldKo Native App** connected app controls who can use the app, IP restrictions, and how long refresh tokens last. | [Connected App](/admin/installation#connected-app) | | IP ranges | Reps connect from mobile networks and store Wi-Fi, so their IP addresses change constantly. | [Restrict IP Ranges for Reps](#restrict-ip-ranges-for-reps) | | Login history | Shows every login attempt and why it failed | [Troubleshoot Logins with Login History](#troubleshoot-logins-with-login-history) | ## Refresh Tokens for Offline Reps Reps often work for hours, or days, without a connection. The app keeps working offline and uses its refresh token to start a new session the next time it connects. After install, the **FieldKo Native App** connected app keeps refresh tokens until they're revoked. If your policy requires refresh tokens to expire, set the expiry longer than the longest time a rep might work without logging in again, such as a holiday or a long trip. When a refresh token expires or is revoked, the app asks the rep to log in again the next time it connects. The rep needs a connection to log in. Before you shorten the refresh token policy, revoke a rep's access, or reset a rep's password, ask the rep to tap **Sync** and wait for it to finish, so their offline work reaches Salesforce first. See [Log Out Safely](/sync/logging-out). To change the policy, see [Connected App](/admin/installation#connected-app). For Salesforce's options, see [Manage OAuth Access Policies for a Connected App](https://help.salesforce.com/s/articleView?id=sf.connected_app_manage_oauth.htm\&type=5) in Salesforce Help. ## Restrict IP Ranges for Reps Login IP ranges on a profile block logins from any address outside the ranges. Because reps' addresses change with every network, don't set login IP ranges on rep profiles unless reps always connect through a company VPN. After install, the **FieldKo Native App** connected app relaxes IP restrictions, so the app keeps working outside your trusted IP ranges. If you enforce IP restrictions on the connected app, reps can sync only from the networks you allow. For details, see [Restrict Login IP Addresses in Profiles](https://help.salesforce.com/s/articleView?id=sf.login_ip_ranges.htm\&type=5) in Salesforce Help. Your network must also allow `status.salesforce.com`. If it doesn't, first-time setup fails with "Network Required" on the office network. See [Rep Can't Sync at All](/admin/support-diagnostics#rep-cant-sync-at-all). ## Troubleshoot Logins with Login History When a rep can't log in to the app, check their login history first: 1. From Setup, in the Quick Find box, enter `Login History`, and then select **Login History**. 2. Find the rep's username, and then read the **Status** column for the reason, such as an invalid password, a restricted IP address, or a failed verification. You can also open the rep's user record and view the **Login History** related list. For more about the columns, see [Monitor Login History](https://help.salesforce.com/s/articleView?id=sf.users_login_history.htm\&type=5) in Salesforce Help. If the login succeeds but sync fails, the cause is usually access, not login security. See [Diagnose Rep Issues](/admin/support-diagnostics). ## See Also * [Install and Set Up FieldKo](/admin/installation#connected-app) * [Remove a Rep's Access](/platform/day-to-day/remove-a-rep) * [Security Model and Sharing](/platform/access/security-model) * [Diagnose Rep Issues](/admin/support-diagnostics) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.