When users log in to Salesforce via the user interface, which two settings does the system check for authentication? Choose 2 answers

When a user attempts to log in to the Salesforce user interface, the system performs several checks to authenticate the user and grant access. Among these are the restrictions defined on the user's assigned profile. The system verifies if the login attempt is within the permissible Login Hours specified on the profile. Additionally, if the Two-Factor Authentication for User Interface Logins permission is enabled for the user (either on their profile or through a permission set), the system will require a second verification factor before granting access.

A. The user’s Two-Factor Authentication for API Logins permission: This permission is specifically checked for authenticating access via the API (e.g., Data Loader, integrations), not for logins through the standard user interface.

B. The role IP address restrictions: IP address restrictions are configured at the Profile level, not the Role level. Roles primarily control record-level access and data visibility within the role hierarchy.

1. Salesforce Help

"Restrict Login Hours for Users": This document states

"Control when users can log in by specifying a range of hours for each profile. When you set login hours

users with that profile can log in only during the specified hours." This directly supports option C.

2. Salesforce Help

"Enable MFA for Specific Users": This guide details the process of assigning the "Multi-Factor Authentication for User Interface Logins" permission to users. It clarifies

"When users with this permission log in to Salesforce through the user interface

they must provide an MFA verification method..." This supports option D and distinguishes it from API authentication (Option A).

3. Salesforce Help

"Restrict Login IP Ranges in the Original Profile User Interface": This source confirms that IP restrictions are a profile-level setting. It states

"By specifying a range of allowed IP addresses on a user’s profile

you can limit their login access to only those IP addresses." This directly refutes the concept of "role IP address restrictions" (Option B).

4. Salesforce Help

"User Roles": This documentation explains that roles "determine the records users can access." It makes no mention of roles being used to control login parameters like IP addresses

further invalidating option B.