aibot88 IP Relaxation And Restriction
The Two Controls (Do Not Confuse)
- Profile → Login IP Ranges: HARD block. Logins from outside the range are refused.
- Network Access → Trusted IPs (org-wide): SOFT relaxation. Logins from these IPs skip the device activation / IP challenge. Outside still allowed (subject to profile rule) but challenged.
Using "Trusted IPs" as a hard control is the most common misconfiguration.
When To Use Which
| Goal | Control |
|---|---|
| Block all logins outside corporate network | Profile Login IP Ranges |
| Reduce MFA / device challenge for office users | Trusted IPs |
| Restrict integration user to partner's egress | Profile Login IP Ranges on integration user's profile |
| Allow travelling user flexibility | Do not use Login IP Ranges; rely on MFA |
Profile Login IP Ranges — Design
- Apply at profile level; narrow scope, narrow blast radius.
- Integration profiles: lock to partner static IPs. Include both primary and DR IPs.
- Admin profile: resist locking too tightly — lockout risk. Use Trusted IPs + MFA instead.
- Standard user profiles: if you enforce, make sure VPN covers remote workers.
Trusted IPs — Design
- Org-wide ranges for offices and VPN egress.
- Keep this list tight: too broad defeats the purpose.
- Review quarterly — ISP changes will leave stale ranges.
Interaction With MFA
- Inside a Trusted IP range, Salesforce skips the device challenge. It does NOT skip MFA if MFA is enforced at session or SSO level.
- Do not treat Trusted IPs as "partial MFA exemption" — MFA should stay.
Interaction With SSO
- Profile Login IP Ranges apply to direct Salesforce login.
- With SSO, the IdP is the initial gate; Salesforce still enforces IP ranges if configured.
- For Connected Apps using JWT/Client Credentials, IP ranges on the Connected App limit where the token can be minted from.
Breakglass Runbook
- When partner IP changes, integration jobs silently fail login.
- Runbook: page on login failure spike → admin updates profile IP range → rerun jobs. Store current IPs and change owner.
Recommended Workflow
- Inventory profiles and their personas.
- Catalog egress IPs per office, VPN, partner integration.
- Apply Profile Login IP Ranges where hard-block is right.
- Configure Trusted IPs for office ranges.
- Do NOT tighten admin profile IP ranges — rely on MFA instead.
- Write the breakglass runbook before enforcing.
- Monitor login failures post-cutover.
Official Sources Used
- Login IP Ranges — https://help.salesforce.com/s/articleView?id=sf.users_profiles_login_ip_ranges.htm
- Trusted IP Ranges (Network Access) — https://help.salesforce.com/s/articleView?id=sf.security_network_access.htm
- Connected App IP Relaxation — https://help.salesforce.com/s/articleView?id=sf.connected_app_create_api_integration.htm