Conditional access: IP, location and work hours
Limit where and when your team can start remote sessions, with IP allow/block lists, a country allow-list and working hours.
Plan: Business and up
On this page
The rules
Set them in Security Policy → Network and access, then Save policy.
Control
What it does
IP block-list (CIDR, comma-separated)
Checked first: a technician on one of these addresses can’t start a session.
IP allow-list (CIDR, comma-separated)
If set, sessions can only be started from these addresses (e.g. your office and VPN ranges).
Geo allow-list (ISO codes, comma-separated)
If set, only from these countries, e.g.
GB,IE.Work hours start / Work hours end
Working hours, in UTC. A window may cross midnight. Sessions outside the window are flagged in Anomaly detection, and are refused when working days are also configured for your workspace.
A refused session returns “access denied by policy” with the reason (blocked IP, not in allow-list, country not allowed, outside work hours).
Tips
- Add your own current address before saving an allow-list, so you don’t lock yourself out of sessions.
- Single addresses work without a
/32. - On plans below Business, saving these fields shows “IP, location and working-hours rules need the Business plan”; the rest of the policy still saves.
- To restrict who can connect by ID + code instead, use Who may connect by ID + code → Only the list below (any plan).
Related help
Security Policy
Workspace-wide guardrails for sessions: clipboard, approval, who may connect by code, screen frame, direct connections, idle timeout, watermark, and network access rules.
Anomaly detection
Real-time rules that flag unusual session behaviour; tune detectors and allow-lists and review what fired.
Single Sign-On and SCIM
Let people sign in with your identity provider over SAML 2.0 or OIDC, and provision users automatically with SCIM.