Network Access trusted IP ranges
Key Takeaway
Trusted IP ranges let users log in from known networks without an identity verification challenge, but they don't block logins. A user outside a trusted range can still log in after verifying their identity. Profile Login IP Ranges are different: they block logins from outside them.
Trusted IP ranges are org-wide lists of IP addresses from which users can log in without an identity verification challenge. You set them on the Network Access page in Setup. Their purpose is to protect data from unauthorized access while sparing users on known networks, such as the office, from extra checks.
What trusted IP ranges do
When a user logs in, the IP address they log in from decides whether Salesforce asks them to verify their identity first.
If a user logs in from inside a trusted IP range...
The login skips the identity verification challenge.
If a user logs in from outside the trusted IP ranges...
Salesforce still allows the login, but it first challenges the user to verify their identity.
For example, an org can add its office network as a trusted IP range. Users who log in from the office then don't have to enter a verification code.