---
schema_version: "1"
id: 415f8e433e71a8d5666acd1a571dccbec9fe7470bef1e86958812bf4509b19d6
title: Add Recommended IP Ranges to the Login Allowlist
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_allowlist_recommendations_add.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_allowlist_recommendations_add.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 825e7ccee607352ad074a377dd55db2e070588953294ce423b5a3d5532653c9a
description: Review recommended IP address ranges and quickly add them to your login IP allowlist. Marketing Cloud Engagement tracks the IP addresses of users who log in to your org, and then suggests trusted IP ranges for your allowlist. Instead of entering IP ranges by hand, you review the suggested ranges and add the ones you trust to your allowlist.
products:
  - Marketing
  - Marketing Cloud Engagement
release: "264"
---
# Add Recommended IP Ranges to the Login Allowlist

Review recommended IP address ranges and quickly add them to your login IP allowlist. Marketing Cloud Engagement tracks the IP addresses of users who log in to your org, and then suggests trusted IP ranges for your allowlist. Instead of entering IP ranges by hand, you review the suggested ranges and add the ones you trust to your allowlist.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: All Marketing Cloud Engagement editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:left;vertical-align:top;" id="d10232e54">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d10232e54 ">To add IP ranges to the login IP allowlist:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d10232e54 ">Marketing Cloud Administrator</td>

          </tr>
        </tbody>
      </table>

To accept suggested login IP ranges, log in to your top-level Enterprise business unit. If you log in to a child business unit, you can view suggested ranges, but you can’t add the ranges to the allowlist.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_important.png)

Important Before you [enable the login allowlist](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_enable_allowlisting.htm&release=264.0.0&type=5 "Configure the behavior of the login IP allowlist in your Marketing Cloud Engagement account."), review the recommended ranges and confirm with your network team that the ranges are correct for your environment. If you’re logged in with an IP address that isn’t in a configured range and you turn on enforcement, Marketing Cloud Engagement blocks your session.

1. Log in to the top-level Enterprise business unit.
2. In Setup, search for and select **Login IP Allowlist**.
3. In the Salesforce Recommended IP Ranges section at the bottom of the page, review each recommended range and its login source.
    
    Each row in the Salesforce Recommended IP Ranges section contains this information.
    
    - **Start IP Address**—The first IP address in the recommended range.
    - **End IP Address**—The last IP address in the recommended range. If the range includes a single address, this value is the same as the Start IP Address.
    - **Login Source**—The source of the logins for the IP range. Possible values are API Calls, User Interface, or API Calls + User Interface.
4. Select the checkbox next to each range that you want to add.
5. Click **Accept Selected**.
6. Review the information on the confirmation window, and then click **Accept IP Ranges**.

A message appears, confirming the number of IP ranges successfully added to the login allowlist. The ranges you accepted move from the Salesforce Recommended IP Ranges section to the Login IP Allowlist table. For each IP range you add this way, the value in the Description column is Recommendation accepted based on tenant traffic patterns.

After you add addresses to the allowlist, [configure the login IP allowlist enforcement settings](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_enable_allowlisting.htm&release=264.0.0&type=5 "Configure the behavior of the login IP allowlist in your Marketing Cloud Engagement account.").

For best results, after you add suggested IP ranges to the allowlist, configure your account to log allowlist violations without denying access. Observe the log and adjust your allowlist over the next few weeks. When there aren’t any violations from known IP ranges, configure your account to log violations and deny access to IP addresses that aren’t on the allowlist.

#### See Also

- [Enable and Configure the Login IP Allowlist](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_enable_allowlisting.htm&release=264.0.0&type=5 "Configure the behavior of the login IP allowlist in your Marketing Cloud Engagement account.")
- [Add IP Addresses to the Login IP Allowlist](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_allowlist_ip.htm&release=264.0.0&type=5 "Add IP addresses and ranges to the login IP allowlist for Marketing Cloud Engagement.")
- [Using the Login IP Allowlist with Broad or Dynamic IP Ranges](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_allowlist_large_ranges.htm&release=264.0.0&type=5 "For the login IP allowlist to be effective, traffic that accesses your Marketing Cloud Engagement account must come from a stable IP range. If your organization uses the public cloud, dynamic infrastructure, or distributed networks, or if you have many remote employees, your users can access Marketing Cloud Engagement from a diverse range of IP addresses. In these situations, establish a stable egress path for your users before you turn on the login IP allowlist in blocking mode.")