---
schema_version: "1"
id: d77d09586e003b8d7c4009df3ca4187be9bdfd7a63caced29458b8b24d80caab
title: Configure Access Settings for B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_ip_address_settings.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_ip_address_settings.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 2e5cde47f19646db8f20ba1b0cdd518cfa69bc081e91c86f56cc02ab3a26b90f
description: Limit access based on IP addresses. If you don't provide an allowlist or blocklist, the feature isn't active and these settings have no effect.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Configure Access Settings for B2C Commerce

Limit access based on IP addresses. If you don't provide an allowlist or blocklist, the feature isn't active and these settings have no effect.

Business Manager IP allowlists and blocklists serve to lock out attackers who have, though illegitimate means, obtained valid credentials. For example, a former employee who obtained credentials when employed, or non-employees who obtained them via social engineering. These lists aren't intended to prevent brute force attacks.

If you log into Business Manager, and you aren't using Unified Authentication, these lists apply _before_ Business Manager verifies your credentials.

If you log in using WebDAV or the agent user login process, and you aren't using Unified Authentication, the lists apply _after_ Business Manager verifies your credentials.

If you log in using Unified Authentication, regardless of how you log in, these lists apply _after_ Business Manager verifies your credentials.

1. In Business Manager, click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration > Global Preferences > Security**.
2. On the Access Restriction tab, enter a range of allowlisted IP addresses allowed to access Business Manager.
3. Enter a range of blocklisted IP addresses not allowed to access Business Manager.
    
    If an IP address is both blocklisted and allowlisted, it's denied access.
4. Select whether you want invalid login attempts recorded to the error log.
5. To have an email sent when an invalid login attempt occurs, enter one or more email addresses, separated by a semicolon.
    
    If you don't provide an email address, no email is sent.
6. Select whether you want to block login access to non-specifically allowlisted IP addresses.
    
    If this option isn’t selected, non-specifically allowlisted IP addresses can access Business Manager.
7. Select whether you want invalid login attempts to count toward the Failed Login Count.
    
    Choosing this option can lock a user out.
8. Click **Apply**.