Restrict Where and When Users Can Log In to Salesforce
- Salesforce checks whether the user’s profile has login hourrestrictions. If login hour restrictions are specified for the user’sprofile, any login outside the specified hours is denied.
- If the user has the “Two-Factor Authentication for User InterfaceLogins” permission, Salesforce prompts the user for a second form ofauthentication upon logging in. If the user’s account isn’t alreadyconnected to a mobile authenticator app such as Salesforce Authenticator,Salesforce first prompts the user to connect the app.
- If the user has the “Two-Factor Authentication for API Logins”permission and has connected an authenticator app to the account, Salesforcereturns an error if the user uses the standard security token. The user hasto enter a verification code (time-based one-time password) generated by theauthenticator app instead.
- Salesforce then checks whether the user’s profile has IP addressrestrictions. If IP address restrictions are defined for the user’sprofile, logins from an undesignated IP address are denied, and logins froma specified IP address are allowed. If the Enforce login IP ranges on every request session setting is enabled, the IPaddress restrictions are enforced for each page request, including requestsfrom client applications.
- If profile-based IP address restrictions are not set, Salesforce checkswhether the user is logging in from a device used to access Salesforce before.If the user’s login is from a device and browser that Salesforce recognizes, the login is allowed.If the user’s login is from an IP address in your org’s trusted IP address list, the login is allowed.If the user’s login is not from a trusted IP address or a device and browser Salesforce recognizes, the login is blocked.
- If the user’s login is from a device and browser that Salesforce recognizes, the login is allowed.
- If the user’s login is from an IP address in your org’s trusted IP address list, the login is allowed.
- If the user’s login is not from a trusted IP address or a device and browser Salesforce recognizes, the login is blocked.
