---
schema_version: "1"
id: e43a4eb4ecd355950f449cdcdfbf463b10454b8e71c94b0a611edabaaec683de
title: Connected App IP Relaxation and Continuous IP Enforcement
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_continuous_ip.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_continuous_ip.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 5878618cf0bb97f739e05a9d74186420cf690e3c03d49102825f9842d594dc6a
description: For security reasons, if you relax IP restrictions for your connected app, and your org has enabled Enforce login IP ranges on every request, users can’t access the app in some circumstances. This access restriction applies to all OAuth-enabled connected apps, including mobile devices.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Connected App IP Relaxation and Continuous IP Enforcement

For security reasons, if you relax IP restrictions for your connected app, and your org has enabled **Enforce login IP ranges on every request**, users can’t access the app in some circumstances. This access restriction applies to all OAuth-enabled connected apps, including mobile devices.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and
            Lightning Experience</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Connected Apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>, <strong>Professional</strong>,
              <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong>
              Editions
            </p>
            <p style="margin-bottom:0;">Connected Apps can be installed in: All editions</p>
          </td>

        </tr>
      </tbody>
    </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

SAML-enabled connected apps aren’t affected, unless they are also OAuth-enabled for single sign-on.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note IP restrictions are enforced only when they’re configured on a user’s profile. SAML bearer assertion and JWT bearer token flows always enforce IP restrictions regardless of the connected app policy.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small " summary="Connected App IP Relaxation Settings and Continuous IP Enforcement">
        <caption>Connected App IP Relaxation Settings and Continuous IP Enforcement</caption>
        <colgroup>
          <col style="width:13.404825737265416%">
          <col style="width:40.3485254691689%">
          <col style="width:46.24664879356569%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d53151e115">IP Relaxation</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d53151e118">When Continuous IP Enforcement Is Disabled (Default)</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d53151e121">When Continuous IP Enforcement Is Enabled</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="IP Relaxation" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e115 ">
              <samp class="parmname">Enforce IP restrictions</samp>
            </td>

            <td data-label="When Continuous IP Enforcement Is Disabled (Default)" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e118 ">A user running this app is subject to the org’s IP restrictions, such as IP ranges set
              in the user’s profile.</td>

            <td data-label="When Continuous IP Enforcement Is Enabled" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e121 ">A user running this app is subject to the org’s IP restrictions, such as IP ranges set
              in the user’s profile.</td>

          </tr>
          <tr class="">
            <td data-label="IP Relaxation" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e115 ">
              <samp class="parmname">Enforce IP restrictions, but relax for refresh tokens</samp>
            </td>

            <td data-label="When Continuous IP Enforcement Is Disabled (Default)" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e118 ">A user running this app is subject to the org’s IP restrictions, such as IP ranges set
              in the user’s profile, during initial login. These restrictions are relaxed when the app
              later uses a refresh token to obtain a new access token.</td>

            <td data-label="When Continuous IP Enforcement Is Enabled" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e121 ">
              <p>A user running this app is subject to the org’s IP restrictions, such as IP ranges set
                in the user’s profile, during initial login. These restrictions are relaxed when the app
                later uses a refresh token to obtain a new access token. However, for security reasons,
                users can’t:</p>
              <ul>
                <li>Change their password</li>
                <li>Register a verification method</li>
                <li>Access pages in a login flow</li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="IP Relaxation" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e115 ">
              <samp class="parmname">Relax IP restrictions for activated devices</samp>
            </td>

            <td data-label="When Continuous IP Enforcement Is Disabled (Default)" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e118 ">
              <p>A user running this app bypasses the org’s IP restrictions when either of these
                conditions is true.</p>
              <ul>
                <li>The app has a list of allowed IP ranges and is using the web server OAuth authorization
                  flow. Only requests coming from these IPs are allowed.</li>
                <li>The app doesn’t have a list of allowed IP-ranges, but it uses the web server
                  authentication flow, and the user successfully completes identity verification if
                  accessing Salesforce from a new browser or device.</li>
              </ul>
            </td>

            <td data-label="When Continuous IP Enforcement Is Enabled" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e121 ">
              <p>A user running this app bypasses the org’s IP restrictions when either of the OAuth
                conditions in the previous column is true. However, for security reasons, users can’t:</p>
              <ul>
                <li>Change their password</li>
                <li>Register a verification method</li>
                <li>Access pages in a login flow</li>
              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="IP Relaxation" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e115 ">
              <samp class="parmname">Relax IP restrictions</samp>
            </td>

            <td data-label="When Continuous IP Enforcement Is Disabled (Default)" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e118 ">A user running this connected app is not subject to any IP restrictions.</td>

            <td data-label="When Continuous IP Enforcement Is Enabled" class="slds-cell-wrap" style="vertical-align:top;" headers="d53151e121 ">
              <p>A user running this connected app is not subject to any IP restrictions. However, for
                security reasons, users can’t:</p>
              <ul>
                <li>Change their password</li>
                <li>Register a verification method</li>
                <li>Access pages in a login flow</li>
              </ul>
            </td>

          </tr>
        </tbody>
      </table>