Restricting sign-in to office networks, safely
Who is involved
| Role | What they do |
|---|---|
| Tenant admin | Builds and arms the allowlist. |
| Employee | Works from an allowed or blocked network. |
| Platform operator | Switches the list off in an emergency. |
Step by step
- Tenant admin
Opens Settings, Network access and adds each office range with a label.
What they see:The administrator's detected address is shown at the top, with whether it is verified.
- Tenant admin
Switches on monitor mode through the settings programming interface (API), since the screen has no switch for it.
What they see:Nobody is blocked, and would-be blocks are recorded.
- Tenant admin
Reviews the recorded events, corrects the list, then arms it by typing the confirmation.
What they see:The administrator's own address is added automatically, and arming is refused if that address cannot be verified.
- Employee
Tries to sign in from a home network that is not on the list.
What they see:Sign-in is refused with a message that the address is not allowed.
- Platform operator
If the company is locked out, switches the allowlist off for it through the administration interface (API).
What they see:The company can sign in again and the action is recorded.
Who is told what
No alert is sent; would-be and real refusals appear in the platform's security feed.