Restrict staff login by country and IP
Open an accepted user in **Settings → Users & Roles → Users**, then choose **Login Access**. You need permission to edit that staff member. The panel shows current access country and IP when available so you can compare them with the proposed restrictions.
Allowed countries
Select the countries from which the staff account should be allowed to log in. Leave the country field empty when no country restriction is intended. Verify the current detected country before applying a rule to your own account; a VPN or network provider can affect the detected location.
Allowed IP addresses or ranges
Enter exact IPv4/IPv6 addresses or CIDR ranges. Use a new line or comma between entries. Wildcards are not supported. Enter the public address seen by the service, not a device’s private local-network address. Check the displayed current IP as a reference.
Combine the rules
When both countries and IP addresses are configured, both must match. Leaving both fields empty permits login from any location under this particular policy; other account and workspace access requirements still apply. Save the user after reviewing the rule.
Verify without losing access
Keep an authorized recovery administrator available and test the intended account from an allowed network. A changing home/mobile IP or a VPN can invalidate an exact-IP rule later. If access is unexpectedly denied, have an authorized administrator review the saved fields and detected network rather than trying to bypass the restriction.
Use **Active Sessions** separately to inspect or sign out an existing authorized session. Changing a location rule and deliberately signing out a session are different operations.