A Salesforce Administrator at Vanguard Health configures login access restrictions for users assigned to the Telehealth Specialist profile. The organization-wide Network Access settings contain a trusted IP range of 203.0.113.0 to 203.0.113.255. On the Telehealth Specialist profile, the administrator defines a Login IP Range of 203.0.113.50 to 203.0.113.100 and configures Login Hours from 08:00 to 17:00 Monday through Friday. A telehealth clinician attempts to log in from IP address 203.0.113.10 at 10:00 AM on a Tuesday. Which system behavior will occur during this login attempt?
- The login attempt is denied immediately because the user's IP address falls outside the Profile Login IP Ranges.Answer
- BThe user is prompted for identity verification via SMS or email code because the IP address is outside the profile range but within organization Network Access.
- CThe login attempt is granted without verification because the user's IP address is listed within the organization-wide Network Access trusted IP range.
- DThe login attempt succeeds, but the user is granted read-only session access because the request occurred during valid profile Login Hours.
Answer
The login attempt is denied immediately because the user's IP address falls outside the Profile Login IP Ranges.
When Profile Login IP Ranges are defined, Salesforce enforces a strict denial for any login request outside the specified IP range. Even though the IP address 203.0.113.10 is included in the organization-wide Network Access list, profile-level IP boundaries strictly forbid access, causing the login attempt to be blocked immediately.
Step-by-Step Solution
Key Concept
Profile Login IP Ranges act as strict access boundaries (hard deny), overriding organization-wide Network Access settings which only govern activation challenges.
Estimated Time:2m 0s