IP restrictions
IP restrictions limit where your workspace can be reached from. There are two independent lists: a workspace allowlist that says where people may connect from, and a per-person blocklist that shuts specific addresses out for one individual.
Both screens below are available to workspace administrators only. If you are not an administrator, neither is shown to you.
The workspace allowlist
On Workspace Settings (web: Settings → Workspace Settings; mobile: Admin tab → Workspace Settings), find IP address allowlist, described as "Add allowed IP addresses. When at least one IP is added, only those IPs can access the workspace. Admins are never restricted."
There is no on/off switch. The list itself is the switch:
- Empty, and the screen says "No IP restrictions. All users can access from any IP address."
- With at least one entry, it says "IP restriction is active. Only the listed IPs (and admins) can access the workspace."
Adding an address or range
- In the first field, type a single address or a CIDR range — the field suggests "IP or CIDR (e.g. 203.0.113.0/24)". IPv4 and IPv6 are both accepted.
- In the second, optionally give it a name — "Label (optional, e.g. Office WiFi)". The label is for you; it changes nothing about who is allowed in.
- Select Add Allowed IP.
Anything that is not a valid address or range is refused with "Enter a valid IP address or CIDR range", and adding the same entry twice is refused with "IP rule already exists".
There is no draft, no preview and no confirmation. The moment your first rule saves, every non-administrator connecting from anywhere else is refused — including people who are in the middle of a conversation. Add the range your team actually works from before you add anything narrower, and tell people first.
Administrators are your way back in: they are never IP-restricted, so an administrator can always sign in and delete the rule. Do not remove your own administrator role while an allowlist is in force, and do not rely on IP rules to restrict an administrator — they do not apply.
Removing a rule
Select the bin icon on the row. It takes effect at once, with no confirmation step, and the screen confirms "Allowed IP removed". Delete the last rule and the workspace goes back to accepting connections from anywhere.
Per-person rules
Individual rules live on the person: Settings → Users → the person. Two controls sit there.
Exempt from IP restriction
A switch, described as "When on, this user can connect from any IP even while the workspace allowlist restricts everyone else."
Use it for the people whose address you cannot pin down — someone travelling, or working from a connection that changes. It lifts the workspace allowlist and their own blocklist for that one person.
Blocked IP Addresses
A list, described as "Block specific IP addresses for this user. The user will be denied access from these IPs." When it is empty it reads "No blocked IPs. This user can access from any allowed IP."
Adding one works like the allowlist: an address or range — "IP or CIDR to block (e.g. 192.168.1.100)" — an optional "Label (optional, e.g. Mobile device)", then Block IP. The bin icon removes an entry.
This list is a denial, and it applies only to the person you added it to. It does not affect anyone else, and it does not open up an address that the workspace allowlist excludes.
How the two lists combine
Every connection is judged in this order, and the first line that matches decides it:
| Order | Check | Outcome |
|---|---|---|
| 1 | Is the person an administrator? | Allowed. Nothing below is consulted. |
| 2 | Does their address match one of their own blocked entries? | Refused — unless they are Exempt from IP restriction. |
| 3 | Is the workspace allowlist empty? | Allowed. |
| 4 | Does their address match the allowlist? | Allowed. |
| 5 | Anything else | Refused — unless they are Exempt from IP restriction. |
The checks cover the whole app, not just sign-in: ordinary requests and the live connection that delivers messages are both tested, so a person whose address stops matching loses the workspace mid-session rather than at their next login.
What a blocked person sees
"Your IP is not authorized to access this service. Please contact your administrator."
Nothing on their side tells them which rule caught them, or what address they would need. If somebody reports that message, check their entry in Blocked IP Addresses first, then the workspace allowlist, then consider Exempt from IP restriction.