A global healthcare organization is onboarding a remote clinical care team into Salesforce. Compliance policies dictate that members of this team must strictly be prevented from logging in if they are outside the corporate Virtual Private Network (VPN) IP range (192.0.2.0 - 192.0.2.255). However, all other standard employees in the organization must retain the ability to log in from any external location by completing an identity verification challenge (MFA) when outside the trusted network. Which configuration strategy should the Salesforce Administrator implement to enforce this requirement for the new remote care team?
- Assign the clinical care team users a custom profile configured with the IP range (192.0.2.0 - 192.0.2.255) under the Login IP Ranges section of that profile.Answer
- BAdd the corporate VPN IP address range (192.0.2.0 - 192.0.2.255) to Network Access under the organization-wide Security Controls.
- CCreate a Permission Set containing the trusted IP range (192.0.2.0 - 192.0.2.255) under its Login IP Ranges settings and assign it to the remote clinical care users.
- DFreeze the user accounts automatically whenever an IP address outside the corporate VPN range is detected during a login attempt.
Answer
Assign the clinical care team users a custom profile configured with the IP range (192.0.2.0 - 192.0.2.255) under the Login IP Ranges section of that profile.
Configuring Login IP Ranges on the Profile enforces a strict security boundary. Users assigned to a profile with defined Login IP Ranges are completely prohibited from authenticating if their request originates outside the specified IP range. Meanwhile, users on other profiles remain governed by organization-wide settings.
Step-by-Step Solution
Key Concept
Profile Login IP Ranges vs. Org-Wide Network Access
Estimated Time:2m 0s