Connected app policies: IP relaxation, sessions and handlers
The admin-side policies of a connected app or external client app: the four IP Relaxation options and their limits under continuous IP enforcement, session timeout and high assurance, mobile PIN, start URL, the custom connected app handler, the permissions to manage apps, installing uninstalled apps, and why new integrations use external client apps.
Given a scenario, identify the configuration settings for a Connected App.
~7 min read · 13 practice questions ·
What the exam expects
- Choose the IP Relaxation option that matches where users authenticate and where the app keeps running, and know when profile IP ranges still win.
- Predict what continuous IP enforcement takes away from users of a relaxed app.
- Configure session policies (timeout, high assurance, block), mobile PIN policies and the start URL, and spot when a policy breaks a non-interactive flow.
- Explain when each Auth.ConnectedAppPlugin method runs and when it needs an execution user.
- Name the permissions needed to manage connected apps, the fix for uninstalled-app errors, and why new integrations use external client apps.
Key terms: IP Relaxation (OAuth policy deciding whether org IP restrictions apply to the app); continuous IP enforcement (the session setting Enforce login IP ranges on every request); high assurance session required (session policy demanding MFA for the app); execution user (the Run As user of a custom connected app handler); uninstalled connected app (an app users authorized but no admin installed); external client app (the new generation of connected apps).
Key facts
- Detail
- Enforce IP restrictions
- Detail
- IP restrictions enforced only when configured on the profile
- Detail
- Always enforce IP restrictions, whatever the policy
- Detail
- No password change, method registration or login flow pages
- Detail
- Falls back to profile, then org Session Settings
- Detail
- Ends all current sessions and prevents new ones
- Detail
- Require Pin after needs a Pin Length of 4-8 digits
- Detail
- Not invoked when users self-authorize
- Detail
- Required for authorize, refresh, modifySAMLResponse
- Detail
- Customize Application + Modify All Data + Manage Profiles and Permission Sets
- Detail
- Install from Connected Apps OAuth Usage
- Detail
- Creation restricted as of Spring '26
Sources for this section (7)
- OAuth Access Policieshelp.salesforce.com (opens in a new tab)
- Continuous IP Enforcementhelp.salesforce.com (opens in a new tab)
- Session Policieshelp.salesforce.com (opens in a new tab)
- Mobile Policieshelp.salesforce.com (opens in a new tab)
- ConnectedAppPlugin Classdeveloper.salesforce.com (opens in a new tab)
- Custom Connected App Handlerhelp.salesforce.com (opens in a new tab)
- Usage Restrictions Changehelp.salesforce.com (opens in a new tab)
- Why does a JWT bearer integration still fail with Relax IP restrictions set?
- When does a handler's refresh method fail while customAttributes works?
- Which three actions are blocked for relaxed-IP users under continuous enforcement?
- Why can last year's users open an uninstalled app that new users can't?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (13 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams