Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
For a Connected Application if I check 'Relax IP Restrictions' flag then does that mean that all users from my organization would be able to access that application?
So this will only impact the security for that particular app or will this affect anything else?
What exactly are the security implications of this setting?
That just means that a user can log in to the specified application regardless of if there are IP restrictions on that users Profile. This would make it so they can only access the standard Salesforce site with whatever IP restrictions are in place for the user, but if they go into the Connected App then they can log in from ANY IP.
This only applies to the specific Connected App that you have edited the settings for.
Keep in mind that Connected Apps use OAuth for authentication. Even if you specify to "Enforce IP restrictions" it will only apply for the initial login. After a user is authenticated to a Connected App they can freely switch IP addresses and their authentication will still refresh with OAuth.
I would typically suggest to just relax IP restrictions unless there is a very strict login policy in place with your organization, and if there is such a strict policy then review OAuth to ensure the refresh behavior is not a concern.
