Require two-factor authentication and restrict IP addresses

Your company can tighten access to its client area with two rules: make two-factor authentication mandatory for all its contacts, and only allow sign-in from certain IP addresses. Both live under My profile › Team, in the Access rules card, and only contacts with full access can change them.

Make two-factor authentication mandatory

1. In Access rules, turn on Two-factor authentication required.
2. Confirm with Require it.

From then on, any contact who doesn't have it yet must turn it on at their next page before using the client area: they only see their Account page, opened on the Sign-in and security tab, with the message "Your company requires two-factor authentication: turn it on below to use the client area." In the contact list, "two-factor on" or "two-factor off" lets you check where everyone stands.

A contact who loses their phone will need one of their recovery codes, or a reset, to get back in.

Restrict allowed addresses

1. In Allowed addresses, enter one address or network per line, for example 198.51.100.7 or 203.0.113.0/24.
2. Click Save the addresses.

Leaving the box empty allows sign-in from anywhere. Your current address is shown under the field. If it isn't in your list, the client area asks you to confirm ("Lock yourself out from here?") before saving, so think twice before clicking Save anyway.

Once the list is in place, sign-in from any other address is refused, and that includes your company's API tokens. A contact who also works for another company sees "This company does not allow sign-in from your address." if they try to switch to yours from an address that isn't allowed.

Good to know

• Up to 50 addresses or networks per list.
• Think about remote work and travel: a company VPN with a fixed address makes life much easier.
• These rules apply to your company only: a contact shared with another company follows each company's rules.
• Rule changes are recorded in the activity log.