What is a login flow, and what would you use one for?

A login flow is a screen flow that runs after authentication succeeds and before the user reaches their landing page. It is assigned by profile, so it can be scoped to a specific population.

Typical uses: capturing acceptance of terms or a data-processing notice on first login, forcing registration of a verification method, collecting or confirming a piece of profile data, presenting a security notice, or ending the session outright when a condition is not met.

What I make sure to say is what it cannot do, because the exam and real projects both probe it: it runs once, at login. It cannot react to something the user does an hour into the session. If the requirement is “block an unusually large export as it happens” or “require step-up when a risky action occurs”, that is Transaction Security in real-time event monitoring, not a login flow.