I was reading below article and it got me little confused(see heading : Org-wide Trusted IP Ranges):


As per this, Salesforce seems to perform, 2 factor authentication before 'Profile IP range' check or Activation(Device/browser) check.

I've two questions: 1. If 2 factor authentication is already successful , does Salesforce perform Profile IP range check ?- This seems true but would like to verify as it is not mentioned in the article clearly. 2. This is little more confusting- does Salesforce perform activation check, if two-factor authentication is already successful ? In the article, this line is confusing:

For access via the user interface, the user is prompted to verify using Salesforce Authenticator (version 2 or later), or to enter a verification code.

Does that mean, again 2 factor authentication is done(if he/she has Salesforce authenticator app). Question is - why he/she needs to do another verification, where using authenticator app or via text verification ?

1 Answer 1


Two factor authentication is not related to Login IP range check.

Salesforce logins process works following way:

  1. User enters credentials on UI or API
  2. Salesforce authenticates the user and perform following checks based on settings the user profile like, Login IP Ranges and/or Login Hours.
  3. If user's IP is not defined in profile, then activation mail is sent and user has to enter activation code. User has an option to remember this machine.
  4. Based on Two factor authentication (let's say if 2nd factor authentication is to be done by Authenticator Mobile App) then user has to enter code for authentication.

Hope you could understand the flow.

  • Hi Santanu, thanks for answering, I've specific question related to your answer- Activation check is done after 2-factor authentication as per Salesforce doc. So question is, if user is successful in two-factor authentication, would salesforce do activation check ?
    – sfdc_Qrius
    Commented Dec 20, 2018 at 10:25
  • Can you point the doc where Activation check is done after 2-factor authentication Commented Dec 21, 2018 at 9:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .