1. If the user's login is from a browser that includes a Sales force cookie, the login is allowed. The browser will have the Sales force cookie if the user has previously used that browser to log in to Sales force, and has not cleared the browser cookies.
2.If the user's login is from an IP address in your organization's trusted IP address list, the login is allowed.
3.If the user's login is from neither a trusted IP address nor a browser with a Sales force cookie, the login is blocked.
4.Whenever a login is blocked or returns an API login fault, Sales force must verify the
user's identity using a temporary verification code sent to the user's email account.