TECH **Salesforce Administrator: Login Hours, IP Ranges, and Multi-Factor Authentication (MFA)**

Salesforce Administrator: Login Hours, IP Ranges, and Multi-Factor Authentication (MFA)

A hyper-practical, zero-fluff guide for real projects and certifications

1. What This Is & Why It Matters

You’re the Salesforce Admin for a global fintech company. Your CEO just got a call from the CISO: "We had a breach—someone logged in from Russia at 3 AM using a stolen password. Why wasn’t MFA enforced? Why wasn’t the login blocked?"

This guide covers three critical security controls in Salesforce: 1. Login Hours – Restrict when users can access Salesforce.
2. IP Ranges – Block or allow logins from specific networks.
3. Multi-Factor Authentication (MFA) – Add a second layer of authentication beyond passwords.

Why this matters in production:
- Compliance: SOC 2, GDPR, and PCI DSS require MFA and IP restrictions.
- Security: 80% of breaches involve stolen credentials (Verizon DBIR). MFA blocks 99.9% of automated attacks.
- Operational control: Prevent after-hours data exfiltration or unauthorized access from high-risk regions.
- Audit readiness: If you can’t prove who logged in, when, and from where, you fail audits.

Real-world scenario:
You inherit a Salesforce org with 500 users. The CFO complains that employees are logging in at 2 AM to export reports. The security team flags logins from Tor exit nodes. You need to: - Block logins outside business hours (9 AM–6 PM local time).
- Restrict logins to corporate VPN IP ranges.
- Enforce MFA for all users (including admins).

If you ignore this, you risk: - Data leaks (e.g., a disgruntled employee downloading leads at midnight).
- Failed audits (e.g., "Why was MFA not enforced for admins?").
- Ransomware (e.g., attackers brute-forcing passwords from a coffee shop Wi-Fi).

2. Core Concepts & Components

? Login Hours

• Definition: Restricts when users can log in to Salesforce (e.g., 9 AM–5 PM, Monday–Friday).
• Production insight: If you don’t set login hours, users can access data 24/7, increasing the risk of after-hours breaches or insider threats.
• Key detail: Login hours are profile-based (not user-based). You can’t set different hours for individual users in the same profile.

? IP Ranges (Login IP Restrictions)

• Definition: Blocks or allows logins from specific IP addresses or ranges (e.g., corporate VPN, office network).
• Production insight: Without IP restrictions, attackers can log in from anywhere—even if they steal a password. Always combine with MFA.
• Key detail: IP ranges are profile-based (like login hours). For org-wide restrictions, use Network Access (Setup → Security Controls → Network Access).

? Multi-Factor Authentication (MFA)

• Definition: Requires users to provide two or more verification factors (e.g., password + SMS code, password + authenticator app).
• Production insight: MFA is the #1 defense against credential stuffing and phishing. Salesforce now requires MFA for all users (enforced in Spring ’23).
• Key detail: MFA can be enforced via:
• Permission Sets (recommended for flexibility).
• Profiles (less flexible, harder to manage).
• Session Security Levels (advanced, rarely used).

? Trusted IP Ranges (Network Access)

• Definition: A list of IP ranges where users bypass MFA (e.g., corporate office, VPN).
• Production insight: If you don’t configure trusted IPs, users will be prompted for MFA every time they log in—even from the office. This creates friction and reduces adoption.
• Key detail: Trusted IPs are org-wide (not profile-based). They apply to all users.

? Login Flows

• Definition: Customizable workflows that run before or after login (e.g., "Show a warning if logging in from a new device").
• Production insight: Use login flows to enforce dynamic policies (e.g., "Block logins from Tor exit nodes" or "Require manager approval for after-hours access").
• Key detail: Login flows are built with Flow Builder (no code required).

? Session Settings

• Definition: Controls how long sessions last, where they’re valid, and when they expire.
• Production insight: If you don’t set session timeouts, users stay logged in indefinitely—even on shared computers. Always set a timeout (e.g., 2 hours).
• Key detail: Session settings are org-wide (Setup → Security Controls → Session Settings).

? Identity Verification Methods

• Definition: The second factor in MFA (e.g., SMS, authenticator app, security key).
• Production insight: SMS is the least secure (SIM swapping attacks). Always prefer authenticator apps (Google Authenticator, Microsoft Authenticator) or security keys (YubiKey).
• Key detail: Salesforce supports:
• Salesforce Authenticator (recommended).
• Third-party TOTP apps (Google Authenticator, Authy).
• Security keys (FIDO2, U2F).

3. Step-by-Step Hands-On: Enforce MFA, Login Hours, and IP Restrictions

Prerequisites

✅ You have System Administrator access to a Salesforce org (sandbox or production).
✅ You have at least 2 test users (one for testing allowed access, one for testing blocked access).
✅ You know your corporate VPN IP range (e.g., 203.0.113.0/24).

Task 1: Enforce MFA for All Users (Using Permission Sets)

Goal: Require MFA for all users (including admins).

Steps:

1. Go to Setup → Permission Sets → New.
2. Label: MFA Enforcement
3. API Name: MFA_Enforcement
4. Description: Enforces MFA for all users.

5. Click Save.

6. Assign the "Multi-Factor Authentication for User Interface Logins" permission:

7. In the permission set, click System Permissions.
8. Click Edit.
9. Check "Multi-Factor Authentication for User Interface Logins".

10. Click Save.

11. Assign the permission set to all users:

12. Go to Setup → Users → Permission Set Assignments.
13. Click Manage Assignments → Add Assignments.

14. Select all users → Assign.

15. Test MFA enforcement:

16. Log out of Salesforce.
17. Log in as a test user.
18. You should be prompted to set up MFA (e.g., Salesforce Authenticator or Google Authenticator).

✅ Verification:
- If MFA is enforced, users cannot log in without setting up a second factor.
- Check Setup → Identity Verification to see which users have registered MFA methods.

Task 2: Restrict Login Hours (9 AM–6 PM, Monday–Friday)

Goal: Block logins outside business hours.

Steps:

1. Go to Setup → Profiles → Select a profile (e.g., Standard User).
2. Scroll to "Login Hours" → Click Edit.
3. Set login hours:
4. Monday–Friday: 9:00 AM – 6:00 PM (in the user’s time zone).
5. Saturday–Sunday: No access (leave blank).

6. Click Save.

7. Test login hours:

8. Log in as a test user outside the allowed hours (e.g., 7 PM).
9. You should see:
   Your login attempt was unsuccessful. You are not allowed to log in at this time.

✅ Verification:
- Check Setup → Login History to confirm blocked logins show "Login Hours Restriction".

Task 3: Restrict Logins to Corporate IP Ranges

Goal: Allow logins only from corporate VPN or office network.

Steps:

1. Go to Setup → Profiles → Select a profile (e.g., Standard User).
2. Scroll to "Login IP Ranges" → Click Edit.
3. Add your corporate IP range:
4. Start IP: 203.0.113.0
5. End IP: 203.0.113.255
6. Description: Corporate VPN

7. Click Save.

8. Test IP restrictions:

9. Log in from outside the allowed IP range (e.g., home Wi-Fi).
10. You should see:
    Your login attempt was unsuccessful. You are not allowed to log in from this IP address.

✅ Verification:
- Check Setup → Login History to confirm blocked logins show "IP Restriction".

Task 4: Set Up Trusted IP Ranges (Bypass MFA for Corporate Network)

Goal: Allow users to skip MFA when logging in from the office or VPN.

Steps:

1. Go to Setup → Security Controls → Network Access.
2. Click New.
3. Add your corporate IP range:
4. Start IP: 203.0.113.0
5. End IP: 203.0.113.255
6. Description: Corporate Office

7. Click Save.

8. Test trusted IP bypass:

9. Log in from inside the trusted IP range (e.g., office VPN).
10. You should not be prompted for MFA.
11. Log in from outside the trusted IP range (e.g., home).
12. You should be prompted for MFA.

✅ Verification:
- Check Setup → Identity Verification to confirm MFA is not required for trusted IPs.

Task 5: Create a Login Flow (Block Tor Exit Nodes)

Goal: Block logins from known Tor exit nodes (common in attacks).

Steps:

1. Go to Setup → Flows → New Flow.
2. Select "Screen Flow" → Click Create.
3. Add a "Get Records" element:
4. Label: Get Login IP Details
5. Object: Login History
6. Filter: UserId = {!$User.Id} (current user)
7. Sort: LoginTime DESC (most recent login)
8. Variable: latestLogin (store the record)
9. Add a "Decision" element:
10. Label: Is Tor Exit Node?
11. Condition: {!latestLogin.SourceIp} contains "tor-exit"
12. (Note: In production, use a Tor exit node API or a custom metadata list of known Tor IPs.)
13. Add a "Screen" element (if Tor IP detected):
14. Label: Block Tor Login
15. Message: Your login attempt was blocked because you are using a Tor exit node.
16. Add a Finish button.
17. Add a "Fault" path (if no Tor IP):
18. Connect to the default login flow.
19. Save & Activate the flow.
20. Assign the flow to profiles:
21. Go to Setup → Profiles → Select a profile.
22. Under Login Flow, select your flow → Save.

✅ Verification:
- Try logging in from a Tor browser (or a known Tor exit IP).
- You should see the block message.

4. ? Production-Ready Best Practices

Security

✅ Enforce MFA for all users (including admins). Salesforce now requires this.
✅ Use permission sets for MFA (not profiles) for flexibility.
✅ Restrict login hours for sensitive profiles (e.g., finance, HR).
✅ Block high-risk countries (e.g., Russia, China) via IP restrictions or login flows.
✅ Monitor failed logins (Setup → Login History) and set up alerts for suspicious activity.

Cost Optimization

⚠️ MFA is free (no additional cost for Salesforce Authenticator or TOTP apps).
⚠️ Avoid SMS MFA (carrier fees apply for some regions).
⚠️ Use trusted IPs to reduce MFA prompts (improves user experience).

Reliability & Maintainability

✅ Document IP ranges (e.g., "Corporate VPN: 203.0.113.0/24").
✅ Use naming conventions for permission sets (e.g., MFA_Enforcement, Finance_Login_Hours).
✅ Test changes in a sandbox first (especially login flows).
✅ Set up a "Break Glass" admin account (exempt from IP/login hour restrictions for emergencies).

Observability

✅ Monitor Login History (Setup → Login History) for:
- Failed logins (possible brute-force attacks).
- Logins from unusual locations (e.g., new country).
- Logins outside business hours.
✅ Set up alerts for:
- 5+ failed logins in 1 hour (possible attack).
- Logins from Tor exit nodes.
- Logins outside trusted IPs.

5. ⚠️ Common Mistakes & Traps

6. ? Exam/Certification Focus (Salesforce Admin)

Typical Question Patterns

1. "Which feature restricts logins to business hours?"
2. ✅ Login Hours (profile-based).
3. ❌ Login Flows (can block, but not time-based by default).

4. ❌ Session Settings (controls session duration, not login times).

5. "How do you bypass MFA for corporate VPN users?"

6. ✅ Trusted IP Ranges (Setup → Network Access).
7. ❌ Login IP Restrictions (blocks logins, doesn’t bypass MFA).

8. ❌ Permission Sets (can enforce MFA, but not bypass it).

9. "What’s the most secure MFA method?"

10. ✅ Security keys (FIDO2/U2F) (phishing-resistant).
11. ⚠️ Authenticator apps (TOTP) (better than SMS).

12. ❌ SMS (vulnerable to SIM swapping).

13. "A user complains they’re locked out after 5 PM. What’s the issue?"

14. ✅ Login Hours are set to 9 AM–5 PM.
15. ❌ IP Restrictions (would show "IP Restriction" error).
16. ❌ MFA (would prompt for a second factor).

Key ⚠️ Trap Distinctions

Common Scenario-Based Question

"Your company wants to block logins from Russia and China. What’s the best approach?"
- ✅ Use a login flow (check IP geolocation and block).
- ⚠️ IP Restrictions (works, but hard to maintain a list of all Russian/Chinese IPs).
- ❌ Login Hours (doesn’t block by country).

7. ? Hands-On Challenge (With Solution)

Challenge:

"A user reports they can log in at 3 AM from their home IP. You need to: 1. Block logins outside 9 AM–6 PM (Monday–Friday). 2. Allow logins only from the corporate VPN (203.0.113.0/24). 3. Enforce MFA for all users, but bypass it for the corporate VPN.

How do you configure this?"

Solution:

1. Set Login Hours (9 AM–6 PM, Monday–Friday) in the user’s profile.
2. Set IP Restrictions (203.0.113.0/24) in the user’s profile.
3. Enforce MFA via a permission set assigned to all users.
4. Add Trusted IP Range (203.0.113.0/24) in Setup → Network Access to bypass MFA.

✅ Why it works:
- Login hours block after-hours access.
- IP restrictions block non-VPN logins.
- MFA is enforced everywhere except the trusted VPN.

8. ? Rapid-Reference Crib Sheet

9. ? Where to Go Next

1. [Salesforce Help: Multi-Factor Authentication](https://