---
schema_version: "1"
id: b6d96b8690c20cfb665c85dd15861de0333dda04a50675d23a2f47a9b8da45de
title: Managing IP Allowlists in Access Management
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/access-management/managing-ip-allowlists.md
canonical_url: https://docs.mulesoft.com/access-management/managing-ip-allowlists
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 02f944b07535b2dccf58262105326f369586268a60e554841852c2c6133bcf45
description: MuleSoft Documentation Site
latest: true
---
---
product: Access Management
version: master
---

# Managing IP Allowlists in Access Management

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Create IP allowlists in Access Management to restrict access to your Anypoint Platform organization
to trusted networks. Enforce IP restrictions for Anypoint Platform logins by adding CIDR blocks to
reduce credential abuse and meet compliance needs.

> [!NOTE]
>
> - This feature is available only for US and EU commercial clouds.
>
> - IP allowlisting applies only to users who sign in with Anypoint Platform credentials. It doesn’t
>   apply to users who authenticate through an external identity provider (IdP) using SSO.

## Before You Begin

- Have the root Organization Administrator permission for your organization.

## Enable or Disable IP Allowlisting

Enable or disable IP allowlisting for your organization’s logins in Access Management. When this
feature is enabled, only logins from IP addresses in allowed CIDR blocks succeed. Login attempts
outside the IP allowlist are blocked and logged.

1.  Log in to Anypoint Platform using an account that has the root Organization Administrator
    permission.

2.  Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu.

3.  In the Access Management navigation menu, select **Security Settings**.

4.  In **IP Allowlist**, enter the IP address CIDR blocks to allow to log in. For example:

    - IP Address CIDR: `192.0.2.0/24`

    - Description: `NE office network`

      > [!NOTE] Only IPv4 addresses are supported. All defined CIDR blocks apply to all users in
      > your organization unless they’re exempted.

5.  (Optional) Click **Add** or **Remove** to add and remove CIDR blocks.

6.  Switch the **Enforce IP restrictions for login** switch on or off to activate or deactivate
    defined IP restrictions for all users within your organization.

    If there aren’t any CIDR blocks configured, this option is disabled.

7.  Click **Save**.

## Manage IP Allowlist Exemptions

You can exempt specific users from the organization-wide IP allowlist restrictions.

> [!NOTE] Root organization administrators are subject to IP enforcement unless explicitly exempted,
> and they’re allowed to self-exempt.

1.  Log in to Anypoint Platform using an account that has the root Organization Administrator
    permission.

2.  Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu.

3.  In the Access Management navigation menu, select **Users**.

4.  Select the user to exempt and then select **Settings**.

5.  Select **Exempt user from IP restrictions**, and then click **Save** to apply the exemption.

## Audit Logging

These actions are logged in the audit log:

- Create, update, and delete actions performed by an Organization Administrator on the allowlist

- Signin failures due to IP restrictions

## See Also

- [Managing Security Settings](https://docs.mulesoft.com/access-management/managing-security-settings)