|
Klasyczne typy plików nie są już dostępne od stycznia 2021 r. Możesz przenieść swoje klasyczne pliki lub pobrać plik PDF. Dowiedz się więcej

IP Address Allowlist feature Implementation

Zamów wersję demonstracyjną
Powiązane z tips

Our organization is looking into using the IP Address Allowlist security feature.  Does anyone else currently use this security feature for their organization and can provide insight on any issues they encountered once implemented (i.e. lock-outs, interruptions, being logged-out of a session, implementation and maintenance of listings, etc.)? 

0

Komentarze

Komentarze: 1

Data Głosy
  • Mike Davis

    Hello, Ryan!

    Great question. I'd be interested in how other orgs are approaching this today too. Below are some tips from the Workiva side we can offer:


    IP Address Allowlist — Overview
     
    The IP Allowlist can be enabled and managed by Org Admins or Security Admins under Security > Access Restrictions. Once enabled, only users connecting from approved IP ranges can access your Workiva account. Both IPv4 and IPv6 are supported.
     
    Note: CIDR notation is not supported — IP addresses and ranges must be entered individually. For a single IP, enter it in both the Range Start and Range End fields.
     
    1. Avoid a Complete Lock-Out (All Users)
    This is the most critical risk to be aware of. If IP addresses are misconfigured or too many are removed while the restriction is still enabled, no users — including admins — may be able to log in.
    - Resolution requires disabling the setting from Org Admin or, if that's not possible, escalating to Workiva Support.
     
    2. Addressing Mid-Session Log-Outs
    If a user's IP address changes during an active session (common in some network environments), Workiva's security implementation will log them out. This is by design and not a platform bug. Engaging your IT team to ensure a stable IP during sessions is the recommended fix.
     
    3. IP Range Entry Behavior
    When entering a large IP range (e.g., 155.190.0.1 to 155.190.255.254), Workiva may break it down into multiple smaller sub-ranges based on binary groupings. This does not affect functionality but can look confusing. There is no known workaround — it's how the system stores ranges internally.
     
    4. Access Blocked Errors
    Users accessing from an IP not on the allowlist will receive an "Access Blocked" error. Ensure all expected IP addresses (including VPN egress IPs, office networks, and remote access points) are added before enabling the feature.
     
    Recommendations Before Enabling
    - Audit all IP addresses your users access Workiva from (offices, VPN, remote, etc.)
    - Always include at least one admin's IP before enabling
    - Test in a controlled rollout before enforcing org-wide
     
    Let me know if you have any follow-ups on the above. Thanks for chiming in and happy Friday!
    0

Zaloguj się, aby dodać komentarz.