Users logging into Salesforce are frequently prompted to verify their identity.

Frequent identity verification prompts in Salesforce are often a session security issue rather than an SSO design defect. One of the standard administrator controls for reducing repeated verification in known corporate environments is to define trusted IP ranges. When a login originates from a recognized network, Salesforce can apply lower-friction verification behavior consistent with the org’s policies. Simply enabling MFA or 2FA does not reduce prompts; those controls often introduce stronger verification requirements. Similarly, moving to an external identity provider changes the sign-in architecture but does not automatically tell Salesforce to trust the user’s network context. The trusted IP model is the documented way to reduce unnecessary verification challenges while keeping the org’s perimeter assumptions explicit. This is why option B is the best answer in Salesforce terms.