# Connected app policies: IP relaxation, sessions and handlers

*Platform Identity and Access Management Architect Study Guide · Access Management Best Practices · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/access-management-best-practices/connected-app-policies-ip-relaxation-sessions-and-handlers*

The admin-side policies of a connected app or external client app: the four IP Relaxation options and their limits under continuous IP enforcement, session timeout and high assurance, mobile PIN, start URL, the custom connected app handler, the permissions to manage apps, installing uninstalled apps, and why new integrations use external client apps.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Access Management Best Practices
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, identify the configuration settings for a Connected App.

## What the exam expects

- Choose the IP Relaxation option that matches where users authenticate and where the app keeps running, and know when profile IP ranges still win.
- Predict what continuous IP enforcement takes away from users of a relaxed app.
- Configure session policies (timeout, high assurance, block), mobile PIN policies and the start URL, and spot when a policy breaks a non-interactive flow.
- Explain when each Auth.ConnectedAppPlugin method runs and when it needs an execution user.
- Name the permissions needed to manage connected apps, the fix for uninstalled-app errors, and why new integrations use external client apps.

Key terms: **IP Relaxation** (OAuth policy deciding whether org IP restrictions apply to the app); **continuous IP enforcement** (the session setting Enforce login IP ranges on every request); **high assurance session required** (session policy demanding MFA for the app); **execution user** (the Run As user of a custom connected app handler); **uninstalled connected app** (an app users authorized but no admin installed); **external client app** (the new generation of connected apps).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Default IP Relaxation | Enforce IP restrictions | [OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |
| No profile ranges | IP restrictions enforced only when configured on the profile | [OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |
| JWT and SAML bearer | Always enforce IP restrictions, whatever the policy | [Continuous IP Enforcement](https://help.salesforce.com/s/articleView?id=sf.connected_app_continuous_ip.htm&language=en_US&type=5) |
| Relaxed + continuous enforcement | No password change, method registration or login flow pages | [Continuous IP Enforcement](https://help.salesforce.com/s/articleView?id=sf.connected_app_continuous_ip.htm&language=en_US&type=5) |
| Timeout Value None | Falls back to profile, then org Session Settings | [Session Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_session_policies.htm&language=en_US&type=5) |
| Block this application | Ends all current sessions and prevents new ones | [Session Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_session_policies.htm&language=en_US&type=5) |
| PIN policy | Require Pin after needs a Pin Length of 4-8 digits | [Mobile Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_mobile.htm&language=en_US&type=5) |
| authorize method | Not invoked when users self-authorize | [ConnectedAppPlugin Class](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_ConnectedAppPlugin.htm) |
| Execution user | Required for authorize, refresh, modifySAMLResponse | [Custom Connected App Handler](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_custom_handler.htm&language=en_US&type=5) |
| Profile and SAML attribute edits | Customize Application + Modify All Data + Manage Profiles and Permission Sets | [OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |
| Uninstalled apps | Install from Connected Apps OAuth Usage | [Usage Restrictions Change](https://help.salesforce.com/s/articleView?id=005132365&language=en_US&type=1) |
| New connected apps | Creation restricted as of Spring '26 | [OAuth Access Policies](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5) |

## Check yourself

- Why does a JWT bearer integration still fail with Relax IP restrictions set?
- When does a handler's refresh method fail while customAttributes works?
- Which three actions are blocked for relaxed-IP users under continuous enforcement?
- Why can last year's users open an uninstalled app that new users can't?

## Sources

- [Manage OAuth Access Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5)
- [Connected App IP Relaxation and Continuous IP Enforcement](https://help.salesforce.com/s/articleView?id=sf.connected_app_continuous_ip.htm&language=en_US&type=5)
- [Manage Session Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_session_policies.htm&language=en_US&type=5)
- [Multi-Factor Authentication for API Access](https://help.salesforce.com/s/articleView?id=xcloud.security_require_2fa_api.htm&language=en_US&type=5)
- [Manage Mobile Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_mobile.htm&language=en_US&type=5)
- [Manage Access to a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage.htm&language=en_US&type=5)
- [ConnectedAppPlugin Class](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_class_Auth_ConnectedAppPlugin.htm)
- [Create a Custom Connected App Handler](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_create_custom_handler.htm&language=en_US&type=5)
- [Prepare for Salesforce Connected App Usage Restrictions Change](https://help.salesforce.com/s/articleView?id=005132365&language=en_US&type=1)
- [Manage Current OAuth Connected App Sessions](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_current_sessions.htm&language=en_US&type=5)
- [Comparison of Connected Apps and External Client Apps Features](https://help.salesforce.com/s/articleView?id=xcloud.connected_apps_and_external_client_apps_features.htm&language=en_US&type=5)
- [External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US&type=5)
- [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams