# Restricting sign-in by IP address

URL: https://bimpsoft.com/en/help/access/ip-restriction/
Updated: 2026-11-06

> To allow sign-in only from certain networks, open "User account → Users → Access settings → IP access", click "+ Add" and enter an IPv4 address or a subnet (CIDR). As soon as the list contains at least one address, sign-in from other addresses is blocked. The restriction does not apply to the company owner or the administrator.

## When you need this

An IP restriction lets employees sign in to Bimp only from trusted networks, for example from the office. Even if a manager's password leaks, an intruder cannot sign in from another address.

**Examples.**
- A sales manager is allowed only the office IP: they work freely from their work computer, while sign-in from home is rejected.
- An analyst works remotely from different cities: their address list is empty, so there are no restrictions.

## How to set up allowed IP addresses

Addresses are set for each [user](https://bimpsoft.com/en/help/access/users/) separately.

1. Open **User account → Users** and find the employee.
2. Click **Access settings**.
3. Open the **IP access** tab (it comes after the "Warehouses", "Project", "Accounts and cash desks" and "Lines of business" tabs).
4. Click **+ Add**.
5. In the "IP address / Mask" field enter the allowed address, and in the "Comment / Description" field enter a location label, for example "Head office Kyiv".
6. Click **Save**.

![The "Access rights" panel with the "IP access" tab highlighted: an info line saying the restrictions do not apply to the company owner or administrator, and one entry in the table, address 100.101.255.255 with the comment "Office"](https://bimpsoft.com/help/_img/9243247b-d4b6-4c03-9c33-8b13481337d9.webp)

To find your current public address, search for "my IP" in a browser or use the 2ip.ua website. Test the settings on a test user first.

## Which address formats are supported

| Format | Example | What it allows |
|---|---|---|
| Single IPv4 address | 192.168.1.10 | sign-in from one device or router |
| Subnet (CIDR) | 192.168.1.0/24 | sign-in from the whole address range of the network |

While the list is empty, there are no restrictions: the tab shows a hint that the user has full access from any address. As soon as at least one address is added, sign-in from all other networks is blocked; the user sees the message "Access from your IP address (…) is restricted by the administrator".

> [!WARNING] Mobile operators and most home providers issue dynamic IP addresses that change periodically. For the office, connect a "Static IP address" service, otherwise employees will not be able to sign in after the address changes.

The restrictions do not apply to the "Company owner" and "Administrator" [roles](https://bimpsoft.com/en/help/access/roles/).

## How to change or remove the restriction

1. On the "IP access" tab, find the entry using the "Search" field (by address or comment).
2. Select the checkboxes next to the rows you need and click **Delete**.
3. To remove the restriction completely, delete all entries: the user can sign in from any address again.

## FAQ

**What happens if an employee tries to sign in from home?**

If the employee has allowed IP addresses in their list and the home address is not among them, sign-in is blocked with the message "Access from your IP address (…) is restricted by the administrator".

**Does the IP restriction apply to the owner and the administrator?**

No. The restrictions are ignored for the "Company owner" and "Administrator" roles, so management always has access, even on a business trip.

**How do I allow an employee to sign in from anywhere?**

Leave the IP address list empty or delete all entries, and there will be no restrictions.

**Why can't employees sign in after we changed internet provider?**

Most home and mobile providers issue dynamic IP addresses. For the office, order a "Static IP address" service from your provider or update the list of allowed addresses.