Operator sign-in network and email restrictions
Restrict operator sign-in networks and the email domains permitted for operator accounts.
What it is
Operator Access Limitation can restrict operator sign-in to approved source IP addresses or ranges. Single sign-on has its own IP Ranges control. Powerfront can also restrict which email domains are permitted when operator accounts are created or updated.
Who uses it and why
Administrators give Powerfront the networks and operator email domains their organisation approves. Operators use an approved network and an allowed account address. Network approval does not replace a password, single sign-on or the permissions needed to use INSIDE.
Where to find it
Powerfront manages Operator Access Limitation and Allowed IPs List under Settings › General Settings › Admin.
Powerfront manages IP Ranges under Settings › Account › Single Sign-On. Approved operator email domains are managed centrally by Powerfront and have no client Settings control here.
How it works
When Operator Access Limitation is enabled, ordinary operator sign-in checks the source IP against the operator's default website's allowed list. A connection outside that list is denied. When the option is off, this particular network check adds no restriction.
SAML and OAuth sign-in can additionally check IP Ranges. A populated list requires an accepted range; an empty list adds no SSO range restriction. This is a separate list from Allowed IPs List.
Approved-email-domain policy checks the domain part of an operator's email address. It applies to account creation and relevant changes, imports and federated provisioning. A rejected address can produce an error stating that its domain is not permitted. Powerfront support addresses have reserved exceptions.
Configure it
Ask Powerfront to review the intended networks before they enable Operator Access Limitation. Supply the public source addresses or ranges used by your office, VPN and other approved operator connections. Supported lists can include individual IP addresses and CIDR ranges.
For single sign-on, ask Powerfront to review IP Ranges as well. For approved operator email domains, include every domain needed for account creation, imports and federation.
Agree the policy for each website involved. Ordinary sign-in uses the default website's list, so reviewing only the website an operator last selected may not explain a denial.
Settings
| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Operator Access Limitation | Settings › General Settings › Admin | website | Off | Powerfront | Enables the website's allowed-IP check for ordinary operator sign-in. |
| Allowed IPs List | Settings › General Settings › Admin | website | Not set: no approved IPs; leave Operator Access Limitation off until a list is configured | Powerfront | Lists the source IP addresses or ranges accepted when Operator Access Limitation is enabled. |
| IP Ranges | Settings › Account › Single Sign-On | website | Not set: no SSO IP range restriction | Powerfront | Applies a separate network list to the configured SAML or OAuth sign-in flow; an empty list adds no SSO range restriction. |
Limits and good to know
- Enabling the ordinary network restriction without a matching address can deny client operators access. An empty allowed list is not equivalent to leaving the option off.
- INSIDE checks the source IP it receives. VPNs, proxies and network routing can change that address.
- This is an admission check, not a guarantee that changing a list immediately disconnects existing sessions.
- Email-domain approval does not verify mailbox ownership or grant sign-in permission by itself.
- Website browser-domain approval and visitor IP anonymisation are separate features.
Depends on and works with
View all connections as a list
This feature uses
- Admin settings and feature switches · managed by PowerfrontConfigured by
Powerfront manages Operator Access Limitation and Allowed IPs List.
- Login and email verificationRelated
Check the operator's default website network policy when ordinary sign-in is denied.
- Single sign-on with SAML 2.0Configured by
SAML sign-in has a separate IP Ranges list managed by Powerfront.
- Single sign-on with OAuth 2.0Configured by
OAuth sign-in also uses the SSO IP Ranges list.
Used by
- Operator accountsConfigured by
Email-domain admission rules can block account creation.
- Importing and exporting operatorsConfigured by
Email-domain admission rules apply during validation.
- Login and email verificationConfigured by
Configured network restrictions can prevent sign-in.
- Single sign-on with SAML 2.0Configured by
Single sign-on network restrictions and new-operator email-domain policy can prevent access.
- Single sign-on with OAuth 2.0Configured by
Network restrictions and new-operator email-domain policy can prevent access.
- SSO operator creation and activationConfigured by
New-operator email-domain validation can block account creation.
FAQ and troubleshooting
Why can I sign in at the office but not from home?
Your home connection may fall outside the allowed source IP list. Use your organisation's approved connection or ask your administrator to arrange a policy review with Powerfront.
Why does single sign-on fail even though the office address is allowed?
Ask Powerfront to check IP Ranges as well as Allowed IPs List. The SSO list is separate, and the address received by INSIDE may differ from the one expected.
Why is a new operator's email address rejected?
Its domain may not be permitted by the effective operator account policy. Ask Powerfront to review the approved domains before retrying creation or import.
Can approving an email domain replace account verification?
No. Domain admission only checks whether the address's domain is allowed. The account must still meet the applicable activation, sign-in and access requirements.
Will changing the allowed list sign everyone out?
Do not assume immediate session revocation. Ask Powerfront to coordinate any separate session action required by your access change.