How to restrict FusionAuth admin panel access to specific IP addresses?

FASupportBot — Invalid Date

Recommended Approaches for FusionAuth Cloud

Since you're using FusionAuth Cloud, here are your options for restricting admin panel access:

Use IP ACLs

You can use the IP ACLs and assign them to the FusionAuth application, which represents the FusionAuth admin UI.

These are an enterprise only feature, so if you are not on that plan, you can't use IP ACLs.

Additional Security Layers

While these don't replace IP restrictions, they add defense in depth:

Tenant Separation: Move all non-admin users to a separate tenant, keeping the default tenant for administrators only Strong MFA: Require multi-factor authentication for all admin users API Key Security: If you use IP ACLs with API keys (see below), you can restrict which IPs can use specific API keys What IP ACLs ARE Good For

While IP ACLs don't protect the admin UI directly, they're still valuable for:

Restricting application access - Apply an IP ACL to specific applications to limit which IPs can authenticate to those apps Restricting tenant access - Apply an IP ACL to a tenant to limit logins across all applications in that tenant Restricting API key usage - Apply an IP ACL to API keys to limit which IPs can use them

To configure an IP ACL:

Navigate to Settings > IP Access Control Click the + icon to create a new ACL Add IP ranges and specify whether to allow or block them Set a default action (allow or block) for IPs that don't match any defined range Assign the ACL to an Application, Tenant, or API Key Emergency Access / Lockout Prevention

Before implementing any IP restrictions (whether via proxy or IP ACLs):

Create a backup API key with full admin privileges that you store securely Test your configuration from an allowed IP address first Document your IP ranges and keep them updated Have a rollback plan - If using a proxy, ensure you can quickly remove or modify the IP restrictions

If you do get locked out:

With IP ACLs on API keys/tenants: Use an unrestricted API key to call the FusionAuth API to modify or remove the ACL Last resort: Contact support (Cloud) Related Documentation Advanced Threat Detection - IP Access Control Lists IP Access Control List API Networking Configuration (Trusted Proxies) FusionAuth Cloud Deployment Community Forum: Restricting Admin Panel Access

Topics tagged with access-control

How to restrict FusionAuth admin panel access to specific IP addresses?