# Operator sign-in network and email restrictions

Restrict operator sign-in networks and the email domains permitted for operator accounts.

*Release 3.3 · admin, operator*

**Settings › General Settings › Admin** · **Settings › Account › Single Sign-On**

## What it is

**Operator Access Limitation** can restrict operator sign-in to approved source IP addresses or ranges. Single sign-on has its own **IP Ranges** control. Powerfront can also restrict which email domains are permitted when operator accounts are created or updated.

## Who uses it and why

Administrators give Powerfront the networks and operator email domains their organisation approves. Operators use an approved network and an allowed account address. Network approval does not replace a password, single sign-on or the permissions needed to use INSIDE.

## Where to find it

Powerfront manages **Operator Access Limitation** and **Allowed IPs List** under **Settings › General Settings › Admin**.

Powerfront manages **IP Ranges** under **Settings › Account › Single Sign-On**. Approved operator email domains are managed centrally by Powerfront and have no client Settings control here.

## How it works

When **Operator Access Limitation** is enabled, ordinary operator sign-in checks the source IP against the operator's default website's allowed list. A connection outside that list is denied. When the option is off, this particular network check adds no restriction.

SAML and OAuth sign-in can additionally check **IP Ranges**. A populated list requires an accepted range; an empty list adds no SSO range restriction. This is a separate list from **Allowed IPs List**.

Approved-email-domain policy checks the domain part of an operator's email address. It applies to account creation and relevant changes, imports and federated provisioning. A rejected address can produce an error stating that its domain is not permitted. Powerfront support addresses have reserved exceptions.

## Configure it

Ask Powerfront to review the intended networks before they enable **Operator Access Limitation**. Supply the public source addresses or ranges used by your office, VPN and other approved operator connections. Supported lists can include individual IP addresses and CIDR ranges.

For single sign-on, ask Powerfront to review **IP Ranges** as well. For approved operator email domains, include every domain needed for account creation, imports and federation.

Agree the policy for each website involved. Ordinary sign-in uses the default website's list, so reviewing only the website an operator last selected may not explain a denial.

### Settings

| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Operator Access Limitation | Settings › General Settings › Admin | website | Off | Powerfront, on request | Enables the website's allowed-IP check for ordinary operator sign-in. |
| Allowed IPs List | Settings › General Settings › Admin | website | Not set: no approved IPs; leave Operator Access Limitation off until a list is configured | Powerfront, on request | Lists the source IP addresses or ranges accepted when Operator Access Limitation is enabled. |
| IP Ranges | Settings › Account › Single Sign-On | website | Not set: no SSO IP range restriction | Powerfront, on request | Applies a separate network list to the configured SAML or OAuth sign-in flow; an empty list adds no SSO range restriction. |

## Limits and good to know

- Enabling the ordinary network restriction without a matching address can deny client operators access. An empty allowed list is not equivalent to leaving the option off.
- INSIDE checks the source IP it receives. VPNs, proxies and network routing can change that address.
- This is an admission check, not a guarantee that changing a list immediately disconnects existing sessions.
- Email-domain approval does not verify mailbox ownership or grant sign-in permission by itself.
- Website browser-domain approval and visitor IP anonymisation are separate features.

## Depends on and works with

### This feature uses

- **Configured in** Admin settings and feature switches (managed by Powerfront): Powerfront manages Operator Access Limitation and Allowed IPs List.
- **Configured in** [Single sign-on with SAML 2.0](SEC-005.md): SAML sign-in has a separate IP Ranges list managed by Powerfront.
- **Configured in** [Single sign-on with OAuth 2.0](SEC-006.md): OAuth sign-in also uses the SSO IP Ranges list.
- **Related** [Login and email verification](SEC-001.md): Check the operator's default website network policy when ordinary sign-in is denied.

### Used by

- **Configures** [Operator accounts](ADM-007.md): Email-domain admission rules can block account creation.
- **Configures** [Importing and exporting operators](ADM-012.md): Email-domain admission rules apply during validation.
- **Configures** [Login and email verification](SEC-001.md): Configured network restrictions can prevent sign-in.
- **Configures** [Single sign-on with SAML 2.0](SEC-005.md): Single sign-on network restrictions and new-operator email-domain policy can prevent access.
- **Configures** [Single sign-on with OAuth 2.0](SEC-006.md): Network restrictions and new-operator email-domain policy can prevent access.
- **Configures** [SSO operator creation and activation](SEC-007.md): New-operator email-domain validation can block account creation.

## FAQ and troubleshooting

### Why can I sign in at the office but not from home?

Your home connection may fall outside the allowed source IP list. Use your organisation's approved connection or ask your administrator to arrange a policy review with Powerfront.

### Why does single sign-on fail even though the office address is allowed?

Ask Powerfront to check **IP Ranges** as well as **Allowed IPs List**. The SSO list is separate, and the address received by INSIDE may differ from the one expected.

### Why is a new operator's email address rejected?

Its domain may not be permitted by the effective operator account policy. Ask Powerfront to review the approved domains before retrying creation or import.

### Can approving an email domain replace account verification?

No. Domain admission only checks whether the address's domain is allowed. The account must still meet the applicable activation, sign-in and access requirements.

### Will changing the allowed list sign everyone out?

Do not assume immediate session revocation. Ask Powerfront to coordinate any separate session action required by your access change.