Salesforce Administration · Security

Why Salesforce Keeps Freezing Your Users (and How to Stop It)

You unfreeze a user, and a few minutes later they’re frozen again. The cause is almost always the same: their traffic is going through a VPN or proxy that Salesforce flags as high-risk.

What’s actually happening

Salesforce runs real-time threat detection on login and API activity. When it sees traffic coming from an anonymizing network, such as a Tor exit node, an open proxy or a high-risk shared IP, it acts automatically. It doesn’t matter if the user is doing nothing wrong.

Anonymized traffic hides where a connection really comes from. To Salesforce, that looks the same as stolen credentials or a hijacked session token, so it plays it safe.

What Salesforce does when it detects this

It takes three actions at the same time:

How to restore access right away

Do these in order. The most common mistake is unfreezing first. Fix the connection, then restore access.

1. Disconnect from the VPN or proxy. Ask the user to turn off whatever VPN or proxy they’re on before trying to log in.
2. Unfreeze the user. Go to Setup → Users, open the user and click Unfreeze.
3. Reset the password. Click Reset Password in Setup, or have the user go through Forgot Password. This step is required after any freeze.
4. Test from a clean connection. Have the user log in from a direct connection, like home broadband or the office network without VPN.
5. Watch it for 48 hours. If the freeze comes back, another device or integration is still going through the flagged network.

Fixing the root cause

Restoring access fixes the symptom. The permanent fix is on the network side, so loop in your IT or security team.

Find the VPN or proxy causing it

Work out which VPN, proxy or routing setup makes Salesforce traffic look like it’s coming from an anonymizing network. Common culprits:

• Consumer VPN services that use shared or residential IP pools
• Split-tunnel setups that push some traffic through anonymizing relays
• Corporate proxies that route outbound traffic through third-party anonymization layers
• MDM or network profiles on phones with a built-in VPN

Add trusted IP ranges in Salesforce

Once IT confirms the legitimate IPs your users connect from, add them as trusted IP ranges:

Add your office and approved VPN IPs or CIDR ranges so Salesforce treats logins from them as trusted.

Switch to a compliant VPN

If your team needs a VPN, use one with dedicated, static IPs that aren’t classified as anonymizing. Your VPN provider should be able to tell you whether their IPs are flagged as open proxies.

Asking Salesforce to waive the freeze for your org

If the VPN fix will take a while, log a case with Salesforce Support and ask for an opt-out from the autonomous security response for OAuth token risks. Include:

• Your org ID and confirmation that you’re a System Administrator
• Whether you need a temporary or permanent exemption, and for how long
• Acknowledgement that the exemption adds security risk to your org

Full resolution checklist

• Disconnected affected users from the VPN or proxy
• Unfroze all affected accounts
• Reset passwords for all affected users
• Confirmed login works from a clean connection
• Reported the issue to IT or security
• Identified the VPN or proxy causing the flag
• Added trusted IP ranges for office and VPN IPs
• Replaced or reconfigured the VPN
• Applied the fix to every affected user, not just one
• Logged a Salesforce case for a waiver, if needed, and noted its expiry

Further reading

Salesforce documents this in its Help portal. Search for autonomous response for OAuth token risks, or look up Help Article ID 005318944 for the official guidance and how exemptions work.

For broader hardening, also review Login IP Ranges, Identity Verification and Connected App policies. They all affect how Salesforce handles suspicious logins.