Login IP ranges versus trusted IPs
Key Takeaway
Think of org-wide trusted IP ranges as a fast lane: users inside the range skip an extra identity check, and users outside it can still log in after verifying their identity. Think of profile login IP ranges as a locked gate: users outside the range can't log in at all.
Salesforce can use IP addresses in two different ways to control logins: org-wide trusted IP ranges and profile login IP ranges. By default, Salesforce doesn't restrict where users log in from, so users can log in from any IP address until you add IP ranges.
Org-wide trusted IP ranges versus profile login IP ranges
| Org-wide trusted IP ranges | Profile login IP ranges | |
|---|---|---|
| Where you set them | In Setup, under "Network Access" | On a profile, under "Login IP Ranges" |
| Who they apply to | The whole org | Users with that profile |
| What they control | Whether a user must complete device activation | Whether users can log in at all |
| Login from inside the range | The range is a known network, so the user logs in without device activation | The login doesn't need device activation if the range is narrow |
| Login from outside the range | These ranges never block a login, but the user must first verify their identity through device activation, for example by entering a verification code | Salesforce blocks the login, regardless of any other settings |
If office users should skip the verification code, but remote users can still log in after verifying...
You should use org-wide trusted IP ranges.
If certain users must never log in from outside the office network...
You should use profile login IP ranges.
Salesforce checks profile login IP ranges first, and they beat everything else. Salesforce blocks a user outside their profile's range even if the user has multi-factor authentication (MFA), and even if their IP address is inside an org-wide trusted IP range.