2 factor authentication vs Device/Browser activation

Question

I was reading below article and it got me little confused(see heading : Org-wide Trusted IP Ranges):

https://help.salesforce.com/articleView?id=admin_loginrestrict.htm&type=5

As per this, Salesforce seems to perform, 2 factor authentication before 'Profile IP range' check or Activation(Device/browser) check.

I've two questions: 1. If 2 factor authentication is already successful , does Salesforce perform Profile IP range check ?- This seems true but would like to verify as it is not mentioned in the article clearly. 2. This is little more confusting- does Salesforce perform activation check, if two-factor authentication is already successful ? In the article, this line is confusing:

For access via the user interface, the user is prompted to verify using Salesforce Authenticator (version 2 or later), or to enter a verification code.

Does that mean, again 2 factor authentication is done(if he/she has Salesforce authenticator app). Question is - why he/she needs to do another verification, where using authenticator app or via text verification ?

Answer 1

Two factor authentication is not related to Login IP range check.

Salesforce logins process works following way:

1. User enters credentials on UI or API
2. Salesforce authenticates the user and perform following checks based on settings the user profile like, Login IP Ranges and/or Login Hours.
3. If user's IP is not defined in profile, then activation mail is sent and user has to enter activation code. User has an option to remember this machine.
4. Based on Two factor authentication (let's say if 2nd factor authentication is to be done by Authenticator Mobile App) then user has to enter code for authentication.

Hope you could understand the flow.