I was reading below article and it got me little confused(see heading : Org-wide Trusted IP Ranges):
https://help.salesforce.com/articleView?id=admin_loginrestrict.htm&type=5
As per this, Salesforce seems to perform, 2 factor authentication before 'Profile IP range' check or Activation(Device/browser) check.
I've two questions: 1. If 2 factor authentication is already successful , does Salesforce perform Profile IP range check ?- This seems true but would like to verify as it is not mentioned in the article clearly. 2. This is little more confusting- does Salesforce perform activation check, if two-factor authentication is already successful ? In the article, this line is confusing:
For access via the user interface, the user is prompted to verify using Salesforce Authenticator (version 2 or later), or to enter a verification code.
Does that mean, again 2 factor authentication is done(if he/she has Salesforce authenticator app). Question is - why he/she needs to do another verification, where using authenticator app or via text verification ?