Trusted IP ranges versus profile login IP ranges
Key Takeaway
Profile login IP ranges block logins from outside the range. Org-wide trusted IP ranges never block a login. They only decide who can skip device activation.
Salesforce has two kinds of IP ranges that affect logins. Org-wide trusted IP ranges, set on the Network Access page, decide which users can skip an extra identity check called device activation. Profile login IP ranges, set on each profile, decide whether a user can log in at all. The key exam skill is knowing which one blocks and which one only challenges.
Org-wide trusted IP ranges
Org-wide trusted IP ranges are a list of addresses from which users can log in without an identity verification challenge. You set them in Setup on the "Network Access" page. Setting them requires the "Manage IP Addresses" permission. The feature is available in all editions.
Trusted IP ranges never block a login. A user outside the org-wide range can still log in, but Salesforce first requires device activation.