Login Hours, Login IP Ranges and Trusted IP Ranges

Why This Topic Matters
Login Hours, Login IP Ranges and Trusted IP Ranges are the first line of defense in a Salesforce org. They control when and from where a user can access your data, before any object, field or record-level security is even evaluated. In the Advanced Administrator exam these settings appear in the Security and Access section, and questions frequently test whether you know the difference between a setting that blocks a login and one that merely skips identity verification. Confusing the profile-level Login IP Ranges with the org-level Trusted IP Ranges is one of the most common mistakes candidates make, so mastering the distinction earns easy points.

What They Are
1. Login Hours – A profile-level setting that defines the days and hours during which users assigned to that profile are allowed to log in. Outside those hours, login attempts are rejected.
2. Login IP Ranges – A profile-level setting that defines the IP addresses from which users with that profile are allowed to log in. Any login attempt from an IP address outside the defined ranges is denied outright.
3. Trusted IP Ranges – An org-wide setting (Setup → Security → Network Access) that defines IP addresses Salesforce considers trusted. Users logging in from a trusted IP are not challenged for identity verification (the activation code sent by email, SMS or authenticator app) and API logins from these addresses do not require a security token.

How Login Hours Work
• Configured on the profile under Login Hours. Each day of the week can have its own start and end time.
• To allow login at any time on a day, clear the times for that day. To prohibit login for an entire day, set Start Time to 12:00 AM and End Time to End of Day.
• The hours are based on the org's default time zone as set in Company Information, not on the individual user's time zone. This is a classic exam trap: a user in a different time zone may be locked out at an unexpected local time.
• If a user is already logged in when the login hours end, the user can continue to view the current page but cannot take any further action; the next action redirects to the login page with a message that the session has expired.
• Login Hours cannot be set on permission sets; they exist only on profiles.
• Denied attempts appear in Login History with a status such as Restricted Time.

How Login IP Ranges Work
• Configured on the profile under Login IP Ranges by specifying a Start IP Address and End IP Address (IPv4 or IPv6; both ends of a range must be the same version).
• A single range cannot include more than 33,554,432 addresses (a /7 CIDR block). You can enter multiple ranges.
• If a user attempts to log in from an IP address outside every range defined on the profile, access is denied. There is no option to verify identity; the login simply fails and Login History records Restricted IP.
• By default the IP check happens only at login. In Setup → Session Settings, enabling Enforce login IP ranges on every request extends the check to every page request, so a user whose IP changes mid-session (for example, leaving the office Wi-Fi) is logged out.
• Login IP Ranges also apply to API, mobile and desktop client logins made with that profile.
• If no Login IP Ranges are defined on a profile, users can log in from anywhere, subject to identity verification.

How Trusted IP Ranges Work
• Configured once for the whole org at Setup → Security → Network Access.
• When a user logs in with username and password from a trusted IP address, Salesforce skips the identity verification (device activation) step.
• When a user logs in from an untrusted, unrecognised IP or browser, Salesforce sends a verification code and requires the user to enter it before granting access. Once the browser is activated, it is remembered via a cookie.
• API and desktop client logins from a trusted IP address do not need the security token appended to the password. From an untrusted IP, the security token is required (or the login must come from a profile whose Login IP Ranges include the address).
• Trusted IP Ranges do not block anyone. They only make login more convenient from known locations.
• Trusted IP Ranges do not bypass Multi-Factor Authentication. Since MFA became a contractual requirement, users from trusted IPs are still prompted for their MFA factor if MFA is enforced for their profile or via the org-wide setting.

How the Three Settings Interact
Think of the sequence Salesforce follows at login:
1. Is the current time within the profile's Login Hours? If not → denied.
2. Is the IP address within the profile's Login IP Ranges (if any are defined)? If not → denied.
3. Is the IP address in the org's Trusted IP Ranges, or is the browser already activated? If yes → proceed (then MFA if required). If no → identity verification challenge, then MFA if required.

Key consequence: a profile Login IP Range is stricter than a Trusted IP Range. If an address is in the Trusted IP Ranges but not in the user's profile Login IP Ranges, the user is still blocked. Conversely, an address inside the profile Login IP Range but outside the Trusted IP Ranges allows the login but may require identity verification on an unrecognised browser.

Typical Business Scenarios
• Call-center agents may only log in 8 AM–6 PM Monday to Friday → Login Hours on the agent profile.
• Contractors must only access Salesforce from the corporate VPN → Login IP Ranges on the contractor profile (optionally with Enforce login IP ranges on every request).
• Users complain about receiving verification codes every time they log in from the office → add the office IP range to Trusted IP Ranges.
• An integration user fails API login with INVALID_LOGIN unless the security token is appended → the integration server IP is not in Trusted IP Ranges (or the profile's Login IP Ranges).
• A user says she was logged out at 5 PM even though the profile allows until 6 PM → Login Hours use the org default time zone, not her local time zone.

Exam Tips: Answering Questions on Login Hours, Login IP Ranges and Trusted IP Ranges
1. Block vs. convenience – If the question says users must be prevented or denied access from certain locations, the answer is profile Login IP Ranges. If it says users should not be prompted for a verification code or should not need a security token, the answer is Trusted IP Ranges (Network Access).
2. Profile vs. org – Login Hours and Login IP Ranges live on the profile. Trusted IP Ranges live at the org level. Neither is available on permission sets.
3. Time zone trap – Login Hours are evaluated against the org's default time zone (Company Information). Questions describing remote users in another time zone being locked out at the wrong time are testing this.
4. Mid-session behavior – When Login Hours expire, the user can still view the current page but cannot perform further actions. When an IP changes mid-session, the user is logged out only if Enforce login IP ranges on every request is enabled in Session Settings.
5. Precedence – Profile Login IP Ranges always win. Being in Trusted IP Ranges never overrides a profile IP restriction.
6. MFA is separate – Trusted IP Ranges do not exempt users from MFA. If an option claims that adding an IP to Trusted IP Ranges removes the MFA prompt, it is a distractor.
7. Security token logic – Security token is required for API or desktop logins from outside Trusted IP Ranges; it is not required when the login comes from a trusted IP or a profile-listed Login IP Range.
8. Login History – Statuses like Restricted Time and Restricted IP indicate a block caused by Login Hours or Login IP Ranges respectively; Invalid Password or Failed: Computer activation required point elsewhere.
9. Multiple profiles with different needs – Because these settings are per profile, a scenario requiring different hours or IP rules for different groups is solved by separate profiles, not by one profile with multiple rules or by permission sets.
10. Read for scope words – The words all users in the org hint at Network Access (Trusted IP Ranges) or Session Settings, while users with the Sales profile hint at profile-level Login Hours or Login IP Ranges.

Quick Reference Summary
• Login Hours → Profile → restricts when → blocks login → org default time zone.
• Login IP Ranges → Profile → restricts where → blocks login → optional enforcement on every request.
• Trusted IP Ranges → Org (Network Access) → marks addresses as safe → skips identity verification and security token → never blocks, never bypasses MFA.

Memorize this three-line summary and apply the block-versus-convenience test, and you will answer virtually every exam question on this topic correctly.