# Org security controls, login restrictions and sessions

*Platform Administrator Study Guide · Configuration and Setup · Last updated September 26, 2026 · https://certifyforce.com/study-guide/platform-administrator/configuration-and-setup/org-security-controls-and-session-settings*

The org-level controls that protect logins and sessions and record who changed what: MFA and identity verification, trusted IP ranges versus profile login IP ranges, login hours, session settings, the Setup Audit Trail, and how an Agentforce agent user's access is governed.

- Certification: Salesforce Platform Administrator
- Exam section: Configuration and Setup
- Study guide: https://certifyforce.com/study-guide/platform-administrator

**Official exam objective:**

> Explain the various organization Security Controls (for example: Identity verification, Setup Audit Trail, Login Hours, Session Settings, agent access).

## What the exam expects

- Explain multi-factor authentication and identity verification, and recover a user who lost their verification method without weakening security for others.
- Choose between trusted IP ranges (skip the verification challenge) and profile login IP ranges (deny logins from anywhere else).
- Restrict when a group of users can log in with profile login hours, and predict what happens to a session when the window closes.
- Pick the session settings that limit the damage from an unattended or hijacked session.
- Use the Setup Audit Trail to answer "who changed this setting, and when".
- Explain what governs an Agentforce agent's data access: the agent user's permissions and record access.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Trusted IP ranges | Inside the range, no identity verification challenge; outside, challenged | [Trusted IP Ranges](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&type=5) |
| Profile login IP ranges | Logins from any other IP address are denied | [Trusted IP Ranges](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&type=5) |
| Change network access | Requires Manage IP Addresses | [Trusted IP Ranges](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&type=5) |
| Login hours | Set per profile, per day of the week | [Login Hours](https://help.salesforce.com/s/articleView?language=en_US&id=users_profiles_epui_login_hours_edit.htm&type=5) |
| Login hours end mid-session | User can view the current page but can't take further action | [Login Hours](https://help.salesforce.com/s/articleView?language=en_US&id=users_profiles_epui_login_hours_edit.htm&type=5) |
| Lock sessions to originating IP | Helps prevent session hijacking | [Session Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&type=5) |
| Force logout on session timeout | Redirects the browser to the login page at timeout | [Session Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&type=5) |
| Setup Audit Trail on screen | 20 most recent setup changes | [Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5) |
| Setup Audit Trail download | Complete history for the past 180 days | [Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5) |
| MFA per user | Multi-Factor Authentication for User Interface Logins permission | [MFA Enforcement](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1) |
| Lost verification method | Admin generates a temporary verification code | [MFA Enforcement](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1) |
| Agent user access | Profile, permission sets, field-level security and sharing | [Service Agent Access](https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_user.htm&type=5) |

## Check yourself

- Why add an office's IP range to trusted IP ranges rather than to profile login IP ranges? → Trusted ranges only skip the verification challenge inside the range; profile login IP ranges deny any login from outside it ([Trusted IP Ranges](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&type=5))
- What does a user experience when their login hours end while they're working? → They can keep viewing the current page but can't take any further action ([Login Hours](https://help.salesforce.com/s/articleView?language=en_US&id=users_profiles_epui_login_hours_edit.htm&type=5))
- Which two session settings best limit the risk of an unattended or hijacked session? → A shorter timeout value with force logout on session timeout, and locking sessions to the originating IP address ([Session Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&type=5))
- When do you download the Setup Audit Trail instead of reading it on screen? → When you need more than the 20 most recent changes; the download covers the past 180 days ([Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5))
- Whose permissions and sharing decide what an Agentforce Service agent can read? → The agent user's profile, permission sets, field-level security and sharing ([Service Agent Access](https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_user.htm&type=5))

## Sources

- [Monitor Setup Changes with Setup Audit Trail](https://help.salesforce.com/s/articleView?id=sf.admin_monitorsetup.htm&language=en_US&type=5)
- [Set Trusted IP Ranges for Your Org](https://help.salesforce.com/s/articleView?id=xcloud.security_networkaccess.htm&type=5)
- [View and Edit Login Hours in Profiles](https://help.salesforce.com/s/articleView?language=en_US&id=users_profiles_epui_login_hours_edit.htm&type=5)
- [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&type=5)
- [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&language=en_US&type=1)
- [Configure Service Agent Access](https://help.salesforce.com/s/articleView?language=en_US&id=ai.agent_user.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 8 linked practice questions, and unlimited timed mock exams are included with the Platform Administrator pack (USD $19): https://certifyforce.com/practice-exams