IP restriction

Allow sign-ins only from your office networks or approved addresses.

Find it at Domains → (your domain) → Network Masks

The tightest of the location controls. Where geo-fencing works at the level of a whole country, this names the exact addresses or ranges a sign-in may come from — typically your office broadband and your VPN.

Writing the list

A single address

Written plainly, for example 203.0.113.5

A range

In CIDR form, for example 198.51.100.0/24

Several entries

Separate each one with a semicolon (;). Both IPv4 and IPv6 are accepted.

It applies only to Internal users

This restriction is governed by each person's Access Type. Users set to Internal must come from the listed networks; users set to External are unaffected. That is how you allow home workers and field staff while pinning office-based accounts to the office.

Home broadband addresses usually change

Most residential connections get a new address periodically, so pinning someone to their home address will lock them out without warning. Use this for fixed office connections and VPN exit addresses, and set remote staff to External.

Check your address before saving

Your own current address is visible in User Logs. Confirm it falls inside the list you are about to save — this control has no observe mode.

Saving the list above does not restrict anyone by itself. Unlike the other controls, IP restriction has no per-user on/off switch: it follows each person's Access Type, so who is covered is decided on their user record.

Applying it to people

1 Save the network masks on the domain, using the page above.
2 Go to Users → All Users and open someone you want to restrict.
3 On the Roles & Access card, set Access Type to Internal.
4 Leave anyone who works remotely as External, or they will be locked out.

Access Type is on the Roles & Access card, not among the Security toggles. Internal means the network masks apply to this person; External means they do not.

Changing many people at once

Users → Bulk Manage Users can set IP Restriction across a selection, which is quicker than opening each record when you are rolling this out to a whole office.