# Login access policy

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Faccount-management%2Fuser-management%2Flogin-access-policy.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Faccount-management%2Fuser-management%2Flogin-access-policy.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[API reference](https://coralogix.com/docs/api-reference/v5/ip-access-service)[Terraform](https://registry.terraform.io/providers/coralogix/coralogix/latest/docs/resources/ip_access)

A login access policy controls who can log in to your Coralogix team, on top of, not in place of, password or SSO authentication. Use it to configure three independent sign-in requirements:

* **IP access**: only the IPv4 addresses and ranges you list can log in to the team.
* **Domain access**: only users whose email address uses a listed domain can log in to the team.
* **Login policy**: enforce SSO login and 2FA for all team members.

The IP access and Domain access tabs are independent allow lists: while a list is empty, that check allows everyone. Add the first entry to start enforcing it. Each team has its own IP access and domain access lists.

## When to use a login access policy[​](#when-to-use-a-login-access-policy "Direct link to When to use a login access policy")

Two common scenarios:

* **Lock the team to corporate networks.** Only sessions originating from your office network or VPN reach the team.
* **Restrict access to company email domains.** Only addresses on the domains you list (for example, `acme.com` and `acme-eng.com`) can authenticate, so personal accounts and lookalike domains cannot be added to the team.

The IP access and Domain access tabs are independent, so you can roll them out one at a time, for example, restrict by email domain first while you collect the IP ranges you want to allow.

Ready to get started?

Open **Settings** and select **Login access policy**, then add your first allowed address on the [IP access](#ip-access) tab.

## What you need[​](#what-you-need "Direct link to What you need")

* A role with the [`TEAM-IP-ACCESS:MANAGE`](https://coralogix.com/docs/user-guides/aaa/access-control/permissions/permissions-list.md) permission to manage IP access. The Platform Admin and TeamAdmin roles can manage both IP access and domain access by default.
* A role with the [`SECURE-LOGIN:MANAGE`](https://coralogix.com/docs/user-guides/aaa/access-control/permissions/permissions-list.md) permission to manage Login policy settings. The Platform Admin role has this permission by default.
* The IP address or range, or the email domain, you want to allow.

[]()

## IP access[​](#ip-access "Direct link to IP access")

The IP access tab lists the IPv4 addresses and CIDR (Classless Inter-Domain Routing) ranges allowed to log in to the team. While the list is empty, the team allows all connections. Once you add the first entry, the team accepts logins only from a listed address or range.

### Add an allowed IP address[​](#add-an-allowed-ip-address "Direct link to Add an allowed IP address")

1. Open **Settings**, select **Login access policy**, and open the **IP access** tab.
2. Select **Add IP address** to open the **Add allowed IP address** dialog.
3. In **IP address**, enter a single IPv4 address or a CIDR range, for example, `192.168.1.1` or `10.0.0.0/24`.
4. (Optional) In **Name**, enter a label such as the office or network name.
5. Leave **Active** on to enforce the entry as soon as you add it, or turn it off to add the entry without enforcing it yet. When inactive, the IP address is not enforced.
6. Select **Add IP address**.

Warning

Adding or activating a range that does not include your current IP address can lock you out of the team. Coralogix warns you before you confirm, and stops you from activating a rule that would cut off your own access.

### Manage IP entries[​](#manage-ip-entries "Direct link to Manage IP entries")

The IP access table shows each entry's IP, Name, and Active state. From the row toolbar you can:

* **Deactivate** or **Activate**: stop or resume enforcing an entry without deleting it. You can also flip the per-row toggle in the Active column.
* **Delete**: remove an entry. Removing the last entry allows connections from everywhere again.
* **Download**: export the current list as a CSV.

The **Coralogix Support Team** row controls access for Coralogix Customer Success over its VPN. Turn it off to block that access.

### Import IP addresses from a CSV[​](#import-ip-addresses-from-a-csv "Direct link to Import IP addresses from a CSV")

Select **Upload CSV** to replace the entire IP allow list from a file.

* Columns: `ip_address` (required), `name`, `enabled` (`true` or `false`, controls the **Active** toggle). Use one entry per row.
* Each value can be a single IPv4 address or a CIDR range.
* Importing replaces all existing entries. Review the preview before you apply it.
* Select **Download template** to start from the expected format.

[]()

## Domain access[​](#domain-access "Direct link to Domain access")

Limited access

Domain access is currently available to selected teams. Speak to Coralogix Customer Support for access.

The Domain access tab lists the email domains allowed to log in to the team. While the list is empty, the team allows all email domains. Once you add the first domain, only users whose email address uses a listed domain can log in.

The table shows each domain's Domain, Name, Source, Added on, Added By, and Affected users. Domains added through cluster configuration or the API appear as read-only and are tagged accordingly.

### Add an allowed domain[​](#add-an-allowed-domain "Direct link to Add an allowed domain")

1. Open the **Domain access** tab.
2. Select **Add domain**.
3. In **Domain**, enter the domain, for example, `acme.com`.
4. (Optional) In **Name**, enter a label such as the company name.
5. Select **Add domain**.

Warning

Removing the domain that matches your own email address blocks your access to the team. Coralogix warns you before you delete your own domain.

### Import domains from a CSV[​](#import-domains-from-a-csv "Direct link to Import domains from a CSV")

Select **Upload CSV** to replace the manually configured domain list from a file.

* Columns: `domain` (required), `name`. Use one entry per row.
* Read-only domains from cluster configuration are not affected by the import.

## Login policy[​](#login-policy "Direct link to Login policy")

The Login policy tab controls authentication requirements for all team members. It has two independent settings: SSO enforcement and 2FA enforcement.

### Enforce SSO[​](#enforce-sso "Direct link to Enforce SSO")

When SSO enforcement is on, new members and members who do not have an explicit login method configured must sign in with SSO. Members who already have an explicit login method set are not affected.

SSO enforcement requires an active SAML configuration on the team. See [SSO with SAML](https://coralogix.com/docs/user-guides/account-management/user-management/sso-with-saml.md).

To enable SSO enforcement:

1. Open **Settings**, select **Login access policy**, and open the **Login policy** tab.
2. Turn on **Enforce SSO**.
3. In the confirmation dialog, select **Enforce SSO**.

To disable SSO enforcement, turn off the **Enforce SSO** toggle.

Warning

SSO enforcement applies to all new members and existing members without an explicit login method. Review your team's login methods in **Settings** > **Team members** before enabling.

### Enforce 2FA for all members[​](#enforce-2fa-for-all-members "Direct link to Enforce 2FA for all members")

When 2FA enforcement is on, every member of the team must set up two-factor authentication before they can continue using Coralogix. Members who have not yet set up 2FA are temporarily blocked from accessing the team until they complete 2FA setup. 2FA enforcement is account-level: enabling it here requires 2FA across all of the user's Coralogix teams, not just this one.

To enable 2FA enforcement:

1. Open **Settings**, select **Login access policy**, and open the **Login policy** tab.
2. Turn on **Enforce 2FA**.
3. In the confirmation dialog, select **Enforce 2FA**.

To disable 2FA enforcement, turn off the **Enforce 2FA** toggle.

Warning

2FA enforcement applies at next sign-in; active sessions aren't signed out. Members who have not yet set up 2FA will be blocked from accessing the team when they next sign in until they complete setup. Communicate the change to your team before enabling it.

## How all three tabs work together[​](#how-all-three-tabs-work-together "Direct link to How all three tabs work together")

IP access, Domain access, and Login policy are evaluated independently. For the allow lists: an empty list never blocks anyone. It allows all IP addresses, or all email domains, for that check. When both lists have entries, a user must satisfy both to log in: connect from an allowed IP address and use an allowed email domain. Login policy settings apply to all members regardless of the allow lists.

## Limitations[​](#limitations "Direct link to Limitations")

* IP access supports IPv4 addresses and IPv4 CIDR ranges only. IPv6 is not supported.
* In CIDR notation, host bits must be zero, for example, use `10.0.0.0/24`, not `10.0.0.5/24`.
* Importing a CSV replaces the entire list for that tab. It is not additive.
* Domains added through cluster configuration are read-only in the UI; you cannot edit or delete them there.
* A domain name can be at most 255 characters.

## Permissions[​](#permissions "Direct link to Permissions")

| Permission                                                                                                               | Description                                                            |
| ------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------- |
| [`TEAM-IP-ACCESS:MANAGE`](https://coralogix.com/docs/user-guides/aaa/access-control/permissions/permissions-list.md)     | Configure and modify the team's IP access list.                        |
| [`TEAM-IP-ACCESS:READCONFIG`](https://coralogix.com/docs/user-guides/aaa/access-control/permissions/permissions-list.md) | View the team's IP access list.                                        |
| [`SECURE-LOGIN:MANAGE`](https://coralogix.com/docs/user-guides/aaa/access-control/permissions/permissions-list.md)       | Configure SSO enforcement and 2FA enforcement on the Login policy tab. |
| [`SECURE-LOGIN:VIEW`](https://coralogix.com/docs/user-guides/aaa/access-control/permissions/permissions-list.md)         | View Login policy settings.                                            |

## API[​](#api "Direct link to API")

You can manage IP access programmatically with the IP Access API, which supports bulk creation and CIDR notation. See the [IP Access](https://coralogix.com/docs/api-reference/v5/ip-access-service/overview) reference.

## Related resources[​](#related-resources "Direct link to Related resources")

* [Login methods](https://coralogix.com/docs/user-guides/account-management/user-management/login-methods.md)
* [SSO with SAML](https://coralogix.com/docs/user-guides/account-management/user-management/sso-with-saml.md)
* [Two-factor authentication](https://coralogix.com/docs/user-guides/account-management/user-management/secure_login/mfa.md)
* [Permissions list](https://coralogix.com/docs/user-guides/aaa/access-control/permissions/permissions-list.md)