← All keys & policies
Policy·enterprise
IP allow list
Tier 1 · HighManagement
Why Tier 1
Grants nothing directly, but adding a range removes the network barrier for stolen credentials used from it.
Manages the IP ranges allowed to reach the enterprise's organizations.
Available on: Enterprise Cloud, EMU. Source
Attack path
Adding an attacker-controlled IP range to the allow list removes a network barrier that would otherwise block credential-based access from outside the corporate network.
Mitigations
- Alert on changes to the allow list
Detect
Alert on ip_allow_list_entry.create, ip_allow_list_entry.update, ip_allow_list.disable, ip_allow_list.disable_for_installed_apps in the audit log.
Related permissions
GitHub Docs: Restricting network traffic to your enterprise with an IP allow list