Northern Trail Outfitters maintains an organization-wide Network Access configuration with trusted IP ranges defined for their corporate offices (198.51.100.0 to 198.51.100.255). A field sales representative whose profile has no Login IP Ranges configured attempts to log into Salesforce from a remote location with IP address 203.0.113.50. What will happen when the agent enters valid login credentials from this external IP address?
- The user receives an identity verification challenge but can log in successfully upon completing verification.Answer
- BThe login attempt is completely blocked because the IP address falls outside the organization's Network Access trusted ranges.
- CThe login attempt is denied unless the external IP address is added to the user's profile Login Hours setting.
- DThe user logs in seamlessly without verification because profile-level restrictions override org-wide Network Access rules.
Answer
The user receives an identity verification challenge but can log in successfully upon completing verification.
Organization-wide Network Access IP ranges define locations from which users can log in without completing an activation or multi-factor identity challenge. When a user logs in from an IP address outside these trusted ranges—and their profile does not have explicit Login IP Ranges configured—Salesforce prompts them for identity verification. Once verified, the login succeeds.
Step-by-Step Solution
Key Concept
Difference between Org Network Access Trusted IP Ranges (identity verification prompt bypass) and Profile Login IP Ranges (hard login restriction).
Estimated Time:1m 30s