Skip to content

Allow or block sign-ins by location

How-to7 minPractitioner

Before you start

A geo fencing policy checks where a sign-in comes from. Allow only the countries or office networks you trust, or block the ones you do not.

The Geofence Policies list with counters for total, active, enforce mode and monitor mode policies, and a card per policy with enable, edit, duplicate and delete icons.
    Create Policy starts a new policy.
    Sort by Priority, Name or Last Updated.
    Each card has icons to enable or disable, Edit, Duplicate and Delete.

Create a policy

Section titled “Create a policy”
  1. Open Account settings › Users & Security and choose Geo Fencing.
  2. Click Create Policy. The New Geofence Policy page opens.
  3. On Basic Information, type a Policy Name, set the Priority and add a Description. Switch Status on.
  4. Open Location. Choose a Location Mode: ALLOWLIST or BLOCKLIST.
  5. Pick a country and click Add. Repeat for each country. Add IP CIDR Ranges, such as 192.168.1.0/24, for office networks.
  6. Open Targets. Pick users with Add User and roles with Add Role.
  7. Click Save Policy.
The Location tab with the location mode menu, a country picker with Add, and chips for the chosen countries.
    Location Mode decides whether the countries are allowed or blocked.
    Pick a country and click Add. Each one becomes a chip.
    IP CIDR Ranges cover office or VPN networks.

With an allowlist, only the countries and ranges you list can sign in. With a blocklist, the ones you list are refused.

Edit, pause or copy a policy

Section titled “Edit, pause or copy a policy”

On the list, the pause icon disables a policy and the play icon enables it, after a confirmation. Edit reopens it, and Duplicate copies it as a starting point for a similar policy. The cards under Enforce Mode and Monitor Mode at the top of the list count your policies.

Include your own country or network in an allowlist before you save, so the policy does not lock you out.

Check yourself

Omar wants staff to sign in only from Egypt and the UAE. Which location mode?
Show the answer

Allowlist. An allowlist permits only the countries you add.

Where do you say whom a policy covers?
Show the answer

On the Targets tab. Targets holds the users and roles the policy applies to.

What's next

Turn on multi-factor sign-inAsk for an email verification code after the password, and choose the code length, how long it lasts and how many tries people get.Set up single sign-onConnect Microsoft Entra ID, Google Workspace, Okta or another OpenID provider so people sign in with their work account.

Last checked