My real problem is that I need to add almost 300 IP ranges to the list of allowed IP addresses of a profile (thanks, Microsoft).

It seems there is still no simple solution for this. On this site I found out that the way to go is to use something called the Metadata API Toolkit. In Classic it could be found via Setup > Develop > Tools, but if I switch nowadays to Classic and look over there, I cannot find it. There is a link to a page called Lightning Platform Tools and Toolkits, but the list on that page does not contain a Metadata API Toolkit.

So it no longer exists or it is no longer supported?

Where can I find it?

If it is no longer available, what other way is there to bulk upload IP ranges to the allowed list of a profile?

  • 2
    Does this answer your question? Profile Login IP Ranges via API
    – identigral
    Dec 22, 2021 at 9:12
  • You can also try github.com/keirbowden/bbsfdx - found via Google, caveat emptor.
    – identigral
    Dec 22, 2021 at 9:14
  • @identigral No, technically it does not answer my question, because that question+answers do not point me to the Metadata Toolkit API. However, I hope the answers there can help me. Unfortunately the code samples are in Java, not Apex, so that is another hurdle to overcome. Dec 22, 2021 at 9:23
  • For Apex, try github.com/financialforcedev/apex-mdapi
    – identigral
    Dec 22, 2021 at 10:07
  • @identigral Yes, I had found that one as well. I guess I'll have to make a new sandbox, download this thing and see what it looks like. Thanks for the pointers. Dec 22, 2021 at 10:28

2 Answers 2


The Metadata API Toolkit is long obsolete, that post is 7 years old. Nowadays you should use sfdx

Once you installed it you can connect it to your org using the sfdx auth:web:login command (run sfdx help auth:web:login for more info)

Then you can retreive the profile using sfdx force:source:retrieve -m Profile:MyProfileName add the ranges to the retreived file and deploy it again using sfdx force:source:deploy (the help command also works for retreive and deploy)

Edit: the link that identigral shared in their comment is a plugin for sfdx that can make it a bit easier, but you don't need the plugin to achieve this.

  • Thanks! I already had sfdx on my system. Your answer is the closest to the original Metadata API Toolkit approach. Dec 22, 2021 at 12:32

As @identigral stated, you are able to accomplish your task with MetadataService.

All you need to do is to know exactly what fullName does Profile have on Metadata level. This question may help you. For eample, Admin states for System Administrator.

Also you need to set up lists of ranges from your document, for a code sample I have created range - This will add new IP ranges to existing ones in Profile.

List<String> startRange = new List<String>{
        '', ''
List<String> endRange = new List<String>{
        '', ''

MetadataService.MetadataPort service = new MetadataService.MetadataPort();
service.SessionHeader = new MetadataService.SessionHeader_element();
service.SessionHeader.sessionId = UserInfo.getSessionId();
service.CallOptions = new MetadataService.CallOptions_element();
service.timeout_x = 120000;

List<MetadataService.Profile> profiles = (List<MetadataService.Profile>) service.readMetadata('Profile', new List<String>{'Admin'}).getRecords(); //read Profile to get existing IP ranges

MetadataService.Profile profile = new MetadataService.Profile();
profile.fullName = 'Admin';
if (profiles[0].loginIpRanges != null) {
    profile.loginIpRanges = profiles[0].loginIpRanges; //set existing IP ranges
} else {
    profile.loginIpRanges = new List<MetadataService.ProfileLoginIpRange>(); //if no IP ranges existed, add empty list

for (Integer i = 0; i < startRange.size(); i++) {
    MetadataService.ProfileLoginIpRange ipRange = new MetadataService.ProfileLoginIpRange();
    ipRange.startAddress = startRange[i];
    ipRange.endAddress = endRange[i];
    profile.loginIpRanges.add(ipRange); //add new IP ranges

List<MetadataService.SaveResult> saveResults = service.updateMetadata(new List<MetadataService.Profile>{profile});
  • I have two observations on this. First, this will not compile as MetadataService.MetadataPort does not exist in standard Apex. I think you have installed a library first that contains this. Second, are you sure this will add IP ranges? It does not do a retrieve first, so I think it will replace the existing IP ranges. Dec 22, 2021 at 11:05
  • @SanderdeJong I have added link to github.com/financialforcedev/apex-mdapi/blob/master/apex-mdapi/… file, where you can get MetadataService with all related classes in it. I have also tested it, it will update login ranges with the ones you'll add (replace in another words). However, you can retrieve Profile metadata first with readMetadata, if you already have some ranges and add new ones to existing loginIpRanges list. Dec 22, 2021 at 11:10
  • 1
    @SanderdeJong I have updated the code to match your use case: retrieve existing IP ranges and add new ones. Dec 22, 2021 at 11:28
  • 1
    I appreciate your efforts, thanks very much. I choose the approach with SFDX, because for me manipulating an XML is easier and cleaner than doing it via code. Also, I do not like to install a third-party library, which I would be required to review extensively. Just installing it can potentially cause trouble, Log4j taught us that much at least. Dec 22, 2021 at 12:35
  • Yep, you are right, of course, but that is not actually a third-party library, this is code generated from .wsdl file, which can be generated directly from SF: Setup -> API -> Metadata API. Just with some minor improvements for readMetadata_element and tests added. But I believe, for your use case XML option is much more suitable. Dec 22, 2021 at 12:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .