Profile login IP ranges
Key Takeaway
If a profile has login IP ranges, a login from outside them is blocked, even with MFA. If a profile has none, its users can log in from any IP address.
Profile login IP ranges are a list of allowed IP addresses that you set on a profile. They keep Salesforce access inside company-controlled networks, such as a corporate VPN or office.
When a profile's login IP ranges block a login
If a profile has one or more login IP ranges...
Users with that profile can log in only from those addresses. A login from any IP address outside those ranges is blocked.
If a profile has no login IP ranges...
Users with that profile can log in from any IP address.
A login from outside the profile's range is always blocked entirely, regardless of any other conditions. Even a strong authentication method such as MFA does not get the user in. So if a user reports they can't log in from home or while traveling, the likely cause is an IP address outside their profile's range.
Salesforce recommends setting up login IP ranges for each profile in the org. Then an attacker with a stolen password can't log in from an external, untrusted location, such as a foreign IP address or public Wi-Fi.