Restrict access by IP address

Available on: Enterprise. This feature is in beta: it is still being built and may change.

An IP allowlist blocks agent sign-in and agent requests from anywhere except the address ranges you list, such as your office network and VPN. Customers, the help centre and the messenger are not affected.

The admin screen for the allowlist is being built. This article describes how the allowlist works today.

The policy

• Enabled: switch the allowlist on or off.
• Rules: address ranges in CIDR form, each with a label, for example 203.0.113.0/24 "Head office".
• Allow the mobile app: let agents use the phone app from anywhere.
• Apply to API tokens: also check requests made with API tokens. When off, integrations keep working from any address.
• Break-glass admins: admins who can always get in, wherever they are.

You can't lock yourself out

When an admin switches the allowlist on, they become a break-glass account unless their own address is covered and other break-glass admins are named. At least one break-glass admin always remains.

The settings show your current IP address and whether it is covered, so you can check before you save.

When it applies

ChaosDesk checks the allowlist at every sign-in and on every agent request. Changes apply within a minute. If your plan no longer includes the feature, the restriction is lifted.

Related

• Set up SAML single sign-on for agents
• Security and privacy overview