Skip to main content

IP allowlist

The IP allowlist restricts your JupiterOne account to a set of source IP addresses that you define. Once enabled, requests coming from any other address are rejected.

The allowlist applies to the whole account, not to individual users or groups. It is configured by account admins in Settings > Admin > Security & Access.

note

The allowlist is an access control, not a network boundary. It does not make JupiterOne unreachable from other addresses — it means requests from those addresses are refused.

What the allowlist blocks​

When the allowlist is enabled, JupiterOne checks the source IP of every authenticated request against your entries and rejects anything that does not match. This covers:

  • Web app usage. Every action a user takes in the JupiterOne app.
  • API and SDK traffic. Anything authenticated with a JupiterOne API token, including the CLI, the SDK, custom scripts, and CI jobs.
  • Integrations you run yourself. Any collector or job that authenticates to JupiterOne with an account or user API token from your own infrastructure.

Blocked requests fail with a permission error. They are not treated as authentication failures, so a blocked user is not prompted to log in again.

What the allowlist does not block​

  • Signing in. A user from a non-allowed address can still authenticate, but no action they take afterward will succeed. Expect this to look like a working login followed by a broken app.
  • Traffic where JupiterOne is the caller rather than you. Inbound callbacks from third-party services — OAuth redirects and similar provider-initiated requests — do not carry your source IP and are not checked.
  • Signed download links. Links that carry their own authorization, such as query-result exports, are not checked.
caution

JupiterOne staff are subject to your allowlist too. Support engineers cannot access your account from outside your allowed addresses. See If you get locked out for what this means for support requests.

Configure the allowlist​

  1. Click Settings (the gear icon) and select Admin.
  2. Open Security & Access and find the IP allowlist section.
  3. Enable the allowlist and add your entries. For each entry, provide:
    • Address or range — a single IPv4 or IPv6 address, or a CIDR block of either family. For example 203.0.113.42, 203.0.113.0/24, 2001:db8::1, or 2001:db8::/48.
    • Label — a short description of what the entry covers, such as HQ office egress or Chicago VPN. Labels are up to 64 characters.
  4. Save your changes.

An account can hold up to 100 entries, and malformed addresses are rejected as you type them. An enabled allowlist with no entries is not a valid configuration and will not save.

Verify your own address first​

The section displays the source IP JupiterOne sees for your current request. This is the value that will actually be compared against your entries, and it is not necessarily the address your machine reports for itself — traffic through a VPN, a corporate proxy, or NAT arrives from the egress address of that hop.

Use the displayed value as your reference when you build the list. If you are unsure what a location's egress range is, get it from whoever manages that network rather than guessing.

Confirming a save​

Some saves ask you to type your account short name before they apply. The confirmation shows your proposed entries next to the source IP JupiterOne sees for you, so you can check your own access before committing. You are asked to confirm when:

  • You turn the allowlist on. Enforcement affects everyone in the account, so this is confirmed even when your own address is covered.
  • Your source IP falls outside the entries you are saving. The confirmation warns you explicitly that you are about to lose access.

Other saves apply without the extra step: turning the allowlist off, and editing an already-enabled list in a way that still covers your own address.

note

You cannot save an enabled allowlist while JupiterOne is unable to determine the address you are connecting from. Without that value there is no way to tell whether your entries cover you.

Avoid locking yourself out​

Saving a list that does not include your own address locks out the person best placed to undo it. Before you save:

  • Confirm your entries cover the source IP shown in the section.
  • Add every egress range your users actually come from — each office, each VPN concentrator, each cloud NAT gateway — not just your own.
  • Include the egress addresses of any automation that authenticates with a JupiterOne API token. A CI runner or a self-hosted collector that falls outside the list stops working as soon as enforcement begins.
  • Remember that ranges change. Consumer ISPs, cellular networks, and CGNAT pools reassign addresses; a home address that works today may not tomorrow. Prefer stable egress points.

Removing an entry or turning the allowlist off​

Editing entries and disabling the allowlist are both done from the same section. Turning the allowlist off leaves your entries in place, so you can re-enable the same list later without re-entering it.

When changes take effect​

Most paths pick up an allowlist change immediately. A few take up to five minutes.

Plan for that window in both directions. Removing an address does not necessarily cut off an in-flight session the instant you save, and access you have just restored may take a few minutes to come back.

If you get locked out​

Contact JupiterOne support. Support can pause enforcement on your account, which restores access without touching your entries — your addresses and labels are preserved exactly as you saved them.

Two things to know about the recovery path:

  • While enforcement is paused, your account is unprotected. The pause is the only way back in, so treat the window as short and re-enable as soon as you have corrected the list.
  • Only you can turn it back on. Support cannot re-enable enforcement or edit your entries. Once you have access again, fix the list in Security & Access and enable the allowlist yourself.

After you re-enable it, allow the propagation window described above before concluding that something is wrong.

Limitations​

  • Not compatible with AWS PrivateLink. If your account reaches JupiterOne over PrivateLink, do not enable an IP allowlist — PrivateLink already restricts network access, and combining the two will break your connectivity. Contact your JupiterOne representative if you are unsure whether this applies to you.
  • Up to 100 entries per account, with labels up to 64 characters.
  • Account-wide only. The allowlist cannot be scoped to a user group, a role, or a specific API token.

Contents