# Ip Relaxation And Restriction

> Design IP-based access controls: profile login IP ranges, org-wide trusted IPs, IP relaxation per profile, and the interaction with MFA and SSO. Trigger keywords: login IP range, trusted IP, IP relaxation, restricted IP, IP allowlist, login hours. Does NOT cover: network-layer firewalling, corporate VPN design, or Shield Event Monitoring.

- Skill: `aibot88/ip-relaxation-and-restriction` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/ip-relaxation-and-restriction`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/ip-relaxation-and-restriction/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/ip-relaxation-and-restriction

---


# IP Relaxation And Restriction

## The Two Controls (Do Not Confuse)

- **Profile → Login IP Ranges**: HARD block. Logins from outside the
  range are refused.
- **Network Access → Trusted IPs (org-wide)**: SOFT relaxation. Logins
  from these IPs skip the device activation / IP challenge. Outside
  still allowed (subject to profile rule) but challenged.

Using "Trusted IPs" as a hard control is the most common misconfiguration.

## When To Use Which

| Goal | Control |
|---|---|
| Block all logins outside corporate network | Profile Login IP Ranges |
| Reduce MFA / device challenge for office users | Trusted IPs |
| Restrict integration user to partner's egress | Profile Login IP Ranges on integration user's profile |
| Allow travelling user flexibility | Do not use Login IP Ranges; rely on MFA |

## Profile Login IP Ranges — Design

- Apply at profile level; narrow scope, narrow blast radius.
- Integration profiles: lock to partner static IPs. Include both primary
  and DR IPs.
- Admin profile: resist locking too tightly — lockout risk. Use Trusted
  IPs + MFA instead.
- Standard user profiles: if you enforce, make sure VPN covers remote
  workers.

## Trusted IPs — Design

- Org-wide ranges for offices and VPN egress.
- Keep this list tight: too broad defeats the purpose.
- Review quarterly — ISP changes will leave stale ranges.

## Interaction With MFA

- Inside a Trusted IP range, Salesforce skips the device challenge. It
  does NOT skip MFA if MFA is enforced at session or SSO level.
- Do not treat Trusted IPs as "partial MFA exemption" — MFA should stay.

## Interaction With SSO

- Profile Login IP Ranges apply to direct Salesforce login.
- With SSO, the IdP is the initial gate; Salesforce still enforces IP
  ranges if configured.
- For Connected Apps using JWT/Client Credentials, IP ranges on the
  Connected App limit where the token can be minted from.

## Breakglass Runbook

- When partner IP changes, integration jobs silently fail login.
- Runbook: page on login failure spike → admin updates profile IP range
  → rerun jobs. Store current IPs and change owner.

## Recommended Workflow

1. Inventory profiles and their personas.
2. Catalog egress IPs per office, VPN, partner integration.
3. Apply Profile Login IP Ranges where hard-block is right.
4. Configure Trusted IPs for office ranges.
5. Do NOT tighten admin profile IP ranges — rely on MFA instead.
6. Write the breakglass runbook before enforcing.
7. Monitor login failures post-cutover.

## Official Sources Used

- Login IP Ranges —
  https://help.salesforce.com/s/articleView?id=sf.users_profiles_login_ip_ranges.htm
- Trusted IP Ranges (Network Access) —
  https://help.salesforce.com/s/articleView?id=sf.security_network_access.htm
- Connected App IP Relaxation —
  https://help.salesforce.com/s/articleView?id=sf.connected_app_create_api_integration.htm