IP allowlist

An IP allowlist makes your workspace answer only to requests from addresses you trust. Even someone with a valid password, or a stolen session, can't get in from anywhere else.

Set it up in Admin → IP allowlist. You need the Manage users, roles and teams permission.

#Add your addresses

1. Enter each address or range, with a label so you remember what it is:

2. Choose + Add my address to add the address you're on now. Knowpoint shows it on the right. If you're connecting over IPv6, it adds your network's /64 range instead, because IPv6 addresses change within it. If your network has both IPv4 and IPv6, add both.
3. Choose whether to also limit the REST API. Leave it on unless your integrations run from addresses you can't list.
4. Tick Turn the allowlist on and save.

Important: Knowpoint won't save a list that leaves out the address you're saving from, so you can't lock yourself out by mistake.

#What it covers

When the allowlist is on, everything in the workspace only works from listed addresses: the sign-in page, every page, Microsoft sign-in and, if you chose it, the API. People elsewhere see "Not available from this network" with their address, so they can tell you what to add. API calls get a 403 error.

The website and Help Center on knowpoint.io aren't affected.

#Tips

• Remote staff: list your VPN's exit address rather than people's home addresses, which change.
• Check your address first: the Your address box should match what api.ipify.org shows (it only uses IPv4, like Knowpoint). Sites such as ifconfig.me may show a longer IPv6 address if your network has one: that's normal, and you only need to list the address Knowpoint shows. If they don't match, contact support before turning the allowlist on.
• Office address changed and you're locked out? Contact Knowpoint support from another network. We can turn your allowlist off, keeping your list, so you can fix it.