Configure IP Address Restrictions & 2FA Requirements

Details

Looking to force the use of a more-secure 2FA method (such as SMS Authentication or an Authenticator App) or to restrict access to your account to certain IP addresses? This guide will walk you through the process.

If you don't see these options (as mentioned below), please ask the Owner of your account to perform these steps for you.

Before We Begin

• You will need to be logged in as the account administrator.
• If you use the API, you are able to restrict access for the API to specific IP's. API access outside those ranges will be blocked.
• If you're using 2FA on our system, you will need to add an IP rule here to allow the API through (but to skip Two-Step Verification).
• Please be aware that if the account being restricted is a sub-account in your Corporate account structure, users of the head / master account will still be able to access it - even if IP restrictions are in place.

How-to Guide

Force the Use of a More-Secure 2FA Method

1. Open the Account area (⚙️ icon, at top right).
2. Select Security from the sidebar.
3. On the Security tab, click Require for all Users and follow the on-screen prompts to enable this for everyone.

Set IP Restrictions on the Account

1. Open the Account area (⚙️ icon, at top right).
2. Select Security from the sidebar.
3. On the IP Restrictions tab, click Add Rule to configure your IP rules - to either allow, or deny, access - as required.

IP rule definitions:

You should reconfigure the default rule if required - this is the setting which will apply to anyone who logs in from an IP which has not been set up in your rules. Please note that if you deny access to all IP's not included in the IP rules list, any users in the excluded IP's may become locked out.

• Allow - uses two-step verification, if it has been configured
• Allow (skip two-step verification) - allows login and bypasses two-step verification
• Allow (require two-step verification) - requires two-step verification process upon login
• Deny - users will be unable to login

Additional Security Measures

Guide for IT Administrators or Security Best Practices