# Org security controls, login restrictions and sessions

*Platform Administrator Study Guide · Configuration and Setup · Last updated September 26, 2026 · https://www.certifyforce.com/study-guide/platform-administrator/configuration-and-setup/org-security-controls-and-session-settings*

The org-level controls that protect logins and sessions and record who changed what: MFA and identity verification, trusted IP ranges versus profile login IP ranges, login hours, session settings, the Setup Audit Trail, Health Check and password policies, and why an agent user's access is a data-access question.

- Certification: Salesforce Platform Administrator
- Exam section: Configuration and Setup
- Study guide: https://www.certifyforce.com/study-guide/platform-administrator

**Official exam objective:**

> Explain the various organization Security Controls (for example: Identity verification, Setup Audit Trail, Login Hours, Session Settings, agent access).

## What the exam expects

- Explain MFA and identity verification, and recover a user who lost their verification method without weakening security for others.
- Choose between trusted IP ranges (skip the challenge) and profile login IP ranges (deny other logins).
- Restrict when users can log in with profile login hours, and predict what happens when the window closes.
- Pick the session settings that limit the damage from an unattended or hijacked session.
- Use the Setup Audit Trail to answer "who changed this setting, and when".
- Read a Health Check score, and set password expiry, complexity and lockout.
- Explain what governs an agent's data access: the agent user's permissions and record access.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Trusted IP ranges | No verification challenge inside the range; challenged outside | [Trusted IP Ranges](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&type=5) |
| Profile login IP ranges | Logins from any other IP address are denied | [Trusted IP Ranges](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&type=5) |
| Change network access | Requires Manage IP Addresses | [Trusted IP Ranges](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&type=5) |
| Login hours | Set per profile, per day of the week | [Login Hours](https://help.salesforce.com/s/articleView?language=en_US&id=users_profiles_epui_login_hours_edit.htm&type=5) |
| Login hours end mid-session | User can view the current page but can't take further action | [Login Hours](https://help.salesforce.com/s/articleView?language=en_US&id=users_profiles_epui_login_hours_edit.htm&type=5) |
| Lock sessions to originating IP | Helps prevent session hijacking | [Session Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&type=5) |
| Force logout on session timeout | Redirects the browser to the login page at timeout | [Session Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&type=5) |
| Setup Audit Trail on screen | 20 most recent setup changes | [Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5) |
| Setup Audit Trail download | Complete history for the past 180 days | [Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5) |
| Health Check | Score against the Salesforce Baseline Standard or up to five custom baselines | [Health Check](https://help.salesforce.com/s/articleView?id=xcloud.security_health_check.htm&type=5) |
| Password policy defaults | Expire in 90 days, 8 characters, 3 remembered, 15-minute lockout | [Password Policies](https://help.salesforce.com/s/articleView?id=xcloud.admin_password.htm&type=5) |
| MFA per user | Multi-Factor Authentication for User Interface Logins permission | [MFA Enforcement](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1) |
| Lost verification method | Admin generates a temporary verification code | [MFA Enforcement](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1) |
| Agent user access | Profile, permission sets, field-level security and sharing | [Service Agent Access](https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_user.htm&type=5) |

## Check yourself

- Why add an office's IP range to trusted IP ranges rather than to profile login IP ranges?
- What does a user experience when their login hours end while they're working?
- Which two session settings best limit the risk of an unattended or hijacked session?
- When do you download the Setup Audit Trail instead of reading it on screen?
- Whose permissions and sharing decide what an Agentforce Service agent can read?

## Sources

- [Monitor Setup Changes with Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5)
- [Set Trusted IP Ranges for Your Org](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&type=5)
- [View and Edit Login Hours in Profiles](https://help.salesforce.com/s/articleView?language=en_US&id=users_profiles_epui_login_hours_edit.htm&type=5)
- [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&type=5)
- [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1)
- [Configure Service Agent Access](https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_user.htm&type=5)
- [Security Health Check](https://help.salesforce.com/s/articleView?id=xcloud.security_health_check.htm&type=5)
- [Set Password Policies](https://help.salesforce.com/s/articleView?id=xcloud.admin_password.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Platform Administrator pack (USD $19): https://www.certifyforce.com/practice-exams