# User authentication: SSO, MFA and login controls

*Platform Administrator II Study Guide · Security and Access · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-administrator-ii/security-and-access/user-authentication-sso-mfa-and-login-controls*

Predict what login IP ranges, trusted IP ranges, login hours and session settings allow or block, where MFA is required or optional, and how SAML SSO, Just-in-Time provisioning, delegated authentication, authentication providers, login flows and session security levels behave.

- Certification: Salesforce Platform Administrator II
- Exam section: Security and Access
- Study guide: https://www.certifyforce.com/study-guide/platform-administrator-ii

**Official exam objective:**

> Given a scenario, determine the implications of user authentication.

## What the exam expects

- Tell a hard login block (profile login IP ranges, login hours) from a verification challenge (trusted IP ranges), and keep a block in force during a session.
- State who must use MFA, how to extend it to API and external logins, and what admins can't do for users.
- Configure SAML single sign-on, Just-in-Time provisioning and an SSO outage path for admins.
- Choose between SAML SSO, delegated authentication and an authentication provider with a registration handler.
- Predict when a login flow runs and how session security levels treat each login method.

Key terms: **login IP ranges** (profile addresses outside which login is denied); **trusted IP ranges** (org addresses that skip identity verification); **Just-in-Time provisioning** (creating users from a SAML assertion at first login); **delegated authentication** (Salesforce calls your web service to check the password); **session security level** (Standard or High Assurance, set by the login method).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Profile login IP ranges | A login from any other IP address is denied | [Restrict Login IP Addresses in Profiles](https://help.salesforce.com/s/articleView?id=sf.users_profiles_epui_login_ip_ranges.htm&language=en_US&type=5) |
| Enforce login IP ranges on every request | Checks profile ranges on each page request, not only at login | [Restrict Login IP Addresses in Profiles](https://help.salesforce.com/s/articleView?id=sf.users_profiles_epui_login_ip_ranges.htm&language=en_US&type=5) |
| Trusted IP ranges | Outside them, users log in after a verification challenge | [Set Trusted IP Ranges for Your Org](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&language=en_US&type=5) |
| Login hours end mid-session | User can view the current page but take no further action | [Control Access to the Org](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_org) |
| MFA scope | Required for internal users in production orgs and sandboxes | [MFA for Direct Salesforce Logins](https://help.salesforce.com/s/articleView?id=xcloud.security_mfa_overview.htm&language=en_US&type=5) |
| MFA for API or external users | API Logins permission; User Interface Logins permission | [MFA for Direct Salesforce Logins](https://help.salesforce.com/s/articleView?id=xcloud.security_mfa_overview.htm&language=en_US&type=5) |
| SAML values matched to the assertion | Issuer and Entity ID | [Step 2: Create a SAML SSO Setting](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.sso_service_provider_configuration.htm&type=5) |
| Disable login with Salesforce credentials | Applies only to users with Is Single Sign-On Enabled | [Require Users to Log In with SSO](https://help.salesforce.com/s/articleView?id=xcloud.sso_enforce_sso_login.htm&language=en_US&type=5) |
| Delegated authentication passwords | The external service enforces password policies | [Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication.htm&language=en_US&type=5) |
| Login flows and API logins | Login flows can't be applied to API logins | [Custom Login Flows](https://help.salesforce.com/s/articleView?id=xcloud.security_login_flow.htm&language=en_US&type=5) |
| High Assurance by default | Multi-factor authentication only | [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US&type=5) |

## Check yourself

- Why doesn't adding a network to trusted IP ranges stop logins from other networks?
- When does a login flow run, and when doesn't it?
- What creates users at first login with an authentication provider such as Google?
- When would you choose delegated authentication over SAML SSO?

## Sources

- [MFA for Direct Salesforce Logins](https://help.salesforce.com/s/articleView?id=xcloud.security_mfa_overview.htm&language=en_US&type=5)
- [Restrict Login IP Addresses in Profiles](https://help.salesforce.com/s/articleView?id=sf.users_profiles_epui_login_ip_ranges.htm&language=en_US&type=5)
- [Set Trusted IP Ranges for Your Org](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&language=en_US&type=5)
- [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US&type=5)
- [Optimize Org Access Control: User Management Guide](https://trailhead.salesforce.com/content/learn/modules/data_security/data_security_org)
- [Step 2: Create a SAML Single Sign-On Setting in Salesforce](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.sso_service_provider_configuration.htm&type=5)
- [Require Users to Log In with Single Sign-On (SSO)](https://help.salesforce.com/s/articleView?id=xcloud.sso_enforce_sso_login.htm&language=en_US&type=5)
- [Just-in-Time Provisioning for SAML](https://help.salesforce.com/s/articleView?id=xcloud.sso_jit_about.htm&language=en_US&type=5)
- [Delegated Authentication](https://help.salesforce.com/s/articleView?id=sf.sso_delauthentication.htm&language=en_US&type=5)
- [Authentication Provider SSO](https://help.salesforce.com/s/articleView?id=xcloud.sso_authentication_providers.htm&language=en_US&type=5)
- [Custom Login Flows](https://help.salesforce.com/s/articleView?id=xcloud.security_login_flow.htm&language=en_US&type=5)
- [Require High-Assurance Session Security for Sensitive Operations](https://help.salesforce.com/s/articleView?id=xcloud.security_auth_require_ha_session.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 17 linked practice questions, and unlimited timed mock exams are included with the Platform Administrator II pack (USD $19): https://www.certifyforce.com/practice-exams