How to Turn Off or Minimize Geolocation Verification in Salesforce

Geolocation verification in Salesforce is a crucial security feature, but it can sometimes hinder development, testing, or automation efforts. This lesson post outlines several strategies to minimize or bypass these checks, making your workflow smoother while maintaining appropriate security for your specific use case.

1. Disable Login IP Range Verification (Per Profile)

This method helps prevent login challenges that are triggered by unfamiliar IP addresses. By defining trusted IP ranges, you can ensure that logins from these locations are not flagged for additional verification.

Steps:

  1. Navigate to Setup in your Salesforce instance.
  2. In the Quick Find box, search for “Profiles” and select the Profile you are currently using (e.g., “System Administrator” or a custom profile for your testing).
  3. Scroll down to the Login IP Ranges section.
  4. Here, you have a couple of options:
    • Add your testing network’s specific IP range: This is the most secure approach, as it only whitelists the IPs you control.
    • Set a wide IP range (e.g., 0.0.0.0 to 255.255.255.255): While convenient for development and testing, be extremely cautious with this option in production or any environment where security is paramount, as it effectively disables IP-based verification for that profile.

2. Disable or Adjust Login History Checks (Optional)

Salesforce uses a combination of login history and location heuristics to identify suspicious activity and trigger security challenges. While you cannot directly “turn off” this heuristic, you can manage its impact:

  • Utilize Trusted IP Ranges: As mentioned in point 1, setting up trusted IP ranges significantly reduces the likelihood of these checks being triggered.
  • Maintain IP Consistency: During automated testing or development, try to avoid frequent changes in your originating IP address. Consistent IP usage from a trusted range will help Salesforce recognize your activity as legitimate.

3. Use a Salesforce Sandbox or Developer Org with Relaxed Security Settings

Sandbox and Developer organizations are designed for development and testing, offering more flexibility in security configurations. This is the ideal environment to experiment with relaxed settings without impacting your production data.

Steps:

  1. Go to Setup in your Sandbox or Developer Org.
  2. In the Quick Find box, search for “Session Settings” and select Session Settings.
  3. Review and consider disabling features that might interfere with your testing, such as:
    • Lock sessions to the IP address from which they originated: Disabling this allows a user’s session to remain active even if their IP address changes during the session.
    • Enable caching and secure sessions: Depending on your specific testing scenario, you might find it beneficial to adjust these settings, though typically they are left enabled for performance and security.

For automated processes, the most robust and secure way to bypass browser-based login flows and geolocation challenges is to use API-driven authentication methods.

  • OAuth JWT Bearer Token Flow: This is highly recommended for server-to-server integrations and automated logins. It allows your application to authenticate directly with Salesforce using a JSON Web Token (JWT), completely bypassing interactive login screens, geolocation checks, and Multi-Factor Authentication (MFA) challenges. This is ideal for headless automation.
  • Named Credentials: For integrations within Salesforce (e.g., Apex callouts to external systems or other Salesforce orgs), Named Credentials provide a secure way to manage authentication details. They abstract away the complexities of authentication, including handling tokens and potentially bypassing certain interactive security measures for pre-authorized connections.

Conclusion

While Salesforce’s geolocation verification is a vital security layer, understanding how to manage or bypass it in controlled environments is essential for efficient development and automation. Always prioritize security, especially in production environments, and use the more relaxed settings only in appropriate testing or development sandboxes. By implementing these strategies, you can streamline your Salesforce operations without compromising your overall security posture.