Login access policy
A login access policy controls who can log in to your Coralogix team — on top of, not in place of, password or SSO authentication. Use it to configure three independent sign-in requirements:
- IP access — only the IPv4 addresses and ranges you list can log in to the team.
- Domain access — only users whose email address uses a listed domain can log in to the team.
- Login policy — enforce SSO login and 2FA for all team members.
The IP access and Domain access tabs are independent allow lists: while a list is empty, that check allows everyone. Add the first entry to start enforcing it. Each team has its own IP access and domain access lists.
When to use a login access policy
Two common scenarios:
- Lock the team to corporate networks. Only sessions originating from your office network or VPN reach the team.
- Restrict access to company email domains. Only addresses on the domains you list — for example,
acme.comandacme-eng.com— can authenticate, so personal accounts and lookalike domains cannot be added to the team.
The IP access and Domain access tabs are independent, so you can roll them out one at a time — for example, restrict by email domain first while you collect the IP ranges you want to allow.
Open Settings and select Login access policy, then add your first allowed address on the IP access tab.
What you need
- A role with the
TEAM-IP-ACCESS:MANAGEpermission to manage IP access. The Platform Admin and TeamAdmin roles can manage both IP access and domain access by default. - A role with the
SECURE-LOGIN:MANAGEpermission to manage Login policy settings. The Platform Admin role has this permission by default. - The IP address or range, or the email domain, you want to allow.
IP access
The IP access tab lists the IPv4 addresses and CIDR (Classless Inter-Domain Routing) ranges allowed to log in to the team. While the list is empty, the team allows all connections. Once you add the first entry, the team accepts logins only from a listed address or range.
Add an allowed IP address
- Open Settings, select Login access policy, and open the IP access tab.
- Select Add IP address to open the Add allowed IP address dialog.
- In IP address, enter a single IPv4 address or a CIDR range — for example,
192.168.1.1or10.0.0.0/24. - (Optional) In Name, enter a label such as the office or network name.
- Leave Active on to enforce the entry as soon as you add it, or turn it off to add the entry without enforcing it yet. When inactive, the IP address is not enforced.
- Select Add IP address.
Adding or activating a range that does not include your current IP address can lock you out of the team. Coralogix warns you before you confirm, and stops you from activating a rule that would cut off your own access.
Manage IP entries
The IP access table shows each entry's IP, Name, and Active state. From the row toolbar you can:
- Deactivate or Activate — stop or resume enforcing an entry without deleting it. You can also flip the per-row toggle in the Active column.
- Delete — remove an entry. Removing the last entry allows connections from everywhere again.
- Download — export the current list as a CSV.
The Coralogix Support Team row controls access for Coralogix Customer Success over its VPN. Turn it off to block that access.
Import IP addresses from a CSV
Select Upload CSV to replace the entire IP allow list from a file.
- Columns:
ip_address(required),name,enabled(trueorfalse— controls the Active toggle). Use one entry per row. - Each value can be a single IPv4 address or a CIDR range.
- Importing replaces all existing entries — review the preview before you apply it.
- Select Download template to start from the expected format.
Domain access
Domain access is currently available to selected teams. Speak to Coralogix Customer Support for access.
The Domain access tab lists the email domains allowed to log in to the team. While the list is empty, the team allows all email domains. Once you add the first domain, only users whose email address uses a listed domain can log in.
The table shows each domain's Domain, Name, Source, Added on, Added By, and Affected users. Domains added through cluster configuration or the API appear as read-only and are tagged accordingly.
Add an allowed domain
- Open the Domain access tab.
- Select Add domain.
- In Domain, enter the domain — for example,
acme.com. - (Optional) In Name, enter a label such as the company name.
- Select Add domain.
Removing the domain that matches your own email address blocks your access to the team. Coralogix warns you before you delete your own domain.
Import domains from a CSV
Select Upload CSV to replace the manually configured domain list from a file.
- Columns:
domain(required),name. Use one entry per row. - Read-only domains from cluster configuration are not affected by the import.
Login policy
The Login policy tab controls authentication requirements for all team members. It has two independent settings: SSO enforcement and 2FA enforcement.
Enforce SSO
When SSO enforcement is on, new members and members who do not have an explicit login method configured must sign in with SSO. Members who already have an explicit login method set are not affected.
SSO enforcement requires an active SAML configuration on the team. See SSO with SAML.
To enable SSO enforcement:
- Open Settings, select Login access policy, and open the Login policy tab.
- Turn on Enforce SSO.
- In the confirmation dialog, select Enforce SSO.
To disable SSO enforcement, turn off the Enforce SSO toggle.
SSO enforcement applies to all new members and existing members without an explicit login method. Review your team's login methods in Settings > Team members before enabling.
Enforce 2FA for all members
When 2FA enforcement is on, every member of the team must set up two-factor authentication before they can continue using Coralogix. Members who have not yet set up 2FA are temporarily blocked from accessing the team until they complete 2FA setup. 2FA enforcement is account-level: enabling it here requires 2FA across all of the user's Coralogix teams, not just this one.
To enable 2FA enforcement:
- Open Settings, select Login access policy, and open the Login policy tab.
- Turn on Enforce 2FA.
- In the confirmation dialog, select Enforce 2FA.
To disable 2FA enforcement, turn off the Enforce 2FA toggle.
2FA enforcement applies at next sign-in; active sessions aren't signed out. Members who have not yet set up 2FA will be blocked from accessing the team when they next sign in until they complete setup. Communicate the change to your team before enabling it.
How all three tabs work together
IP access, Domain access, and Login policy are evaluated independently. For the allow lists: an empty list never blocks anyone — it allows all IP addresses, or all email domains, for that check. When both lists have entries, a user must satisfy both to log in: connect from an allowed IP address and use an allowed email domain. Login policy settings apply to all members regardless of the allow lists.
Limitations
- IP access supports IPv4 addresses and IPv4 CIDR ranges only. IPv6 is not supported.
- In CIDR notation, host bits must be zero — for example, use
10.0.0.0/24, not10.0.0.5/24. - Importing a CSV replaces the entire list for that tab. It is not additive.
- Domains added through cluster configuration are read-only in the UI; you cannot edit or delete them there.
- A domain name can be at most 255 characters.
Permissions
| Permission | Description |
|---|---|
TEAM-IP-ACCESS:MANAGE | Configure and modify the team's IP access list. |
TEAM-IP-ACCESS:READCONFIG | View the team's IP access list. |
SECURE-LOGIN:MANAGE | Configure SSO enforcement and 2FA enforcement on the Login policy tab. |
SECURE-LOGIN:VIEW | View Login policy settings. |
API
You can manage IP access programmatically with the IP Access API, which supports bulk creation and CIDR notation. See the IP Access reference.