Restrict access with an IP allowlist

Allow sign-in and use of the workspace only from your office or VPN networks, with stricter ranges for chosen roles.

For: Workspace admins (Enterprise add-on)

Steps

Open Settings → Security centre → IP allowlist. The page shows the address you are connecting from.
Enter your network ranges, one per line (IPv4 or IPv6, a single address or a CIDR range such as 203.0.113.0/24).
Optional: under Stricter ranges per role, add ranges that people holding that role must also come from (for example, admins only from the office).
Optional: tick Apply to API keys and SCIM too, so integrations must also call from these ranges.
Tick Turn on the IP allowlist and select Save allowlist. If your own address isn't in the list, you are asked to confirm first.

The allowlist applies to sign-in, every page and action, and the MCP server. Each API key can also keep its own list.
MetriCRM support staff signed in to help you (with a stated reason, for at most 30 minutes) and the break-glass admin (while single sign-on is enforced) are not blocked, so a wrong list can always be fixed. Both are recorded in your audit log.
Every change is recorded in the audit log and the other admins are told. Blocked attempts appear as anomalies in the security centre.

Still need help? Contact support

Allow sign-in and use of the workspace only from your office or VPN networks, with stricter ranges for chosen roles.

For: Workspace admins (Enterprise add-on)

Open Settings → Security centre → IP allowlist. The page shows the address you are connecting from.
Enter your network ranges, one per line (IPv4 or IPv6, a single address or a CIDR range such as 203.0.113.0/24).
Optional: under Stricter ranges per role, add ranges that people holding that role must also come from (for example, admins only from the office).
Optional: tick Apply to API keys and SCIM too, so integrations must also call from these ranges.
Tick Turn on the IP allowlist and select Save allowlist. If your own address isn't in the list, you are asked to confirm first.

The allowlist applies to sign-in, every page and action, and the MCP server. Each API key can also keep its own list.
MetriCRM support staff signed in to help you (with a stated reason, for at most 30 minutes) and the break-glass admin (while single sign-on is enforced) are not blocked, so a wrong list can always be fixed. Both are recorded in your audit log.
Every change is recorded in the audit log and the other admins are told. Blocked attempts appear as anomalies in the security centre.

Still need help? Contact support