We significantly increased the IPv6 address limit for trusted IP ranges and profile IP
ranges, and we now exclude private IPs from 10.0.0.0 to
10.255.255.255 when calculating the total. If your IPv6 ranges are now under the
new limit of 2^99 (2 to the power of 99), users can log in from allowlisted IPs without completing
device activation. We apply this limit separately from the IPv4 limit, which is still
16,777,216.
Where: This change applies to Lighting Experience and Salesforce Classic in all editions.
Why: The previous IP address limit of 16,777,216, which was a blanket limit for IPv4 and IPv6 ranges, was too restrictive for IPv6. The previous limit also made it difficult to allowlist private IP addresses.
How: For logins that don’t use multi-factor authentication (MFA) or a strong single sign-on (SSO) authentication method, IP address limits affect device activation.
- For org-wide trusted IP ranges: if your org exceeds the limit, Salesforce issues a device activation challenge even if the user’s IP address is in range.
- For profile login IP ranges: if the specific profile exceeds the limit, Salesforce challenges users for device activation even if the user’s IP address is in range. Salesforce also challenges users if your org ranges exceed the limit, even if the profile ranges don’t. If users are outside of the profile range, Salesforce blocks the login entirely.
This behavior hasn't changed, but with a higher IPv6 limit and more room for private IPs, you can have more control over device activation.