IP allowlist | Pathfinder

Organization administrators can now define an allowlist of trusted networks permitted to access Pathfinder. Only requests that originate from approved public networks can reach protected resources on the Pathfinder web console, the platform application programming interfaces (APIs), and supported platform-routed services.

An IP allowlist applies to your whole organization. It is disabled by default until an administrator configures and enables it.

What an IP allowlist protects

When you enable an IP allowlist, Pathfinder controls access to these authenticated resources from approved public source IP addresses:

• Pathfinder console access through app.beyondtrust.io
• Platform REST API requests
• Supported platform-routed Model Context Protocol (MCP) endpoints

Pathfinder evaluates the allowlist against the public IP address it sees, such as your office network address translation (NAT) gateway, secure web gateway, proxy, or virtual private network (VPN) egress point.

Prerequisites

Make sure you have the correct administrative access and a complete list of the public egress addresses your users and integrations use.

• You must be a Pathfinder organization administrator.
• Collect all required public IPv4 and IPv6 addresses or Classless Inter-Domain Routing (CIDR) ranges.
• Include office networks, corporate VPN egress addresses, proxies, secure web gateways, and automation or integration egress ranges.
• Confirm the public IP address your own session currently uses, so you do not block yourself during setup.

Supported formats and limits

Pathfinder accepts these entry formats:

Each entry also takes an optional description. An organization can hold up to 900 allowlist entries.

Plan your rollout

A short planning step helps prevent user disruption:

1. List every network your administrators use to access Pathfinder.
2. List every network that API clients, automation, and service integrations use.
3. Verify whether remote users must connect through VPN to appear from an approved corporate egress IP address.
4. Add descriptive labels so future administrators understand why each range exists.
5. Validate entries before you enable enforcement.

Start with administrator and corporate VPN egress ranges, then add integration and branch office networks before you turn the feature on for general use.

Configure an IP allowlist

1. Sign in to Pathfinder with an organization administrator account.
2. Go to Administration > IP Allowlist.
   This page provides a view of any previously configured allowlist entries and allows you to search them by description, by IP address, or by the email address of the person who added them.

Add individual entries

1. Select Add IP Address.

2. Optionally, enter a description, such as HQ Office NAT, Corporate VPN, or US East Integration Gateway. This description must be 140 characters or fewer.

3. Select the Enter IP Addresses tab.

   

4. Enter public IP addresses or CIDR ranges by typing individual entries or by pasting from an external source. Entries should be separated either by line or by comma. Each IP address or range is validated as you type.

   

   📘

   Validation confirms that an entry is well-formed: valid IPv4 or IPv6 format, valid CIDR prefix, no duplicates. It does not confirm that the address exists or that it is one your users, APIs, or integrations actually connect from. You are responsible for the accuracy of the entries.

5. Once you have corrected any errors are satisifed with the entry, click Add Entry to Allowlist.

Bulk import entries

If you have many entries, use bulk import to speed setup:

1. Select Add IP Address.

2. Optionally, enter a description, such as HQ Office NAT, Corporate VPN, or US East Integration Gateway. This description must be 140 characters or fewer.

3. Select the Import IP Addresses tab.

   

4. Upload a comma-separated values (CSV) file where the first column is the IP address or CIDR range. An optional second column can be used to add descriptions. Multiple rows with the same description are grouped together as one entry.

   

5. Each row is validated upon upload. If there are any validation errors, you must correct and reupload the CSV file.

   📘

   Validation confirms that an entry is well-formed: valid IPv4 or IPv6 format, valid CIDR prefix, no duplicates. It does not confirm that the address exists or that it is one your users, APIs, or integrations actually connect from. You are responsible for the accuracy of the entries.

6. Once you have corrected any errors are satisifed with the entry, click Add Entry to Allowlist.

Enable enforcement

1. To begin allowlisting the configured IP addresses, turn on the Enforcement setting.

   

2. You are prompted to verify that you want to turn on enforcement. If you are sure of your settings, click Turn on.

   

What users can expect

• Users who connect from an approved public network access protected Pathfinder resources normally.
• Users who connect from a non-approved public network can still reach the sign-in page, but Pathfinder denies access to protected resources after authentication.
• Blocked requests return an authorization failure, such as 403 Forbidden.
• Remote users may need to connect through the corporate VPN if their home network is not on the allowlist.

Best practices

• Add a meaningful description to every entry.
• Review the allowlist whenever office networks, VPN providers, proxies, or integration egress ranges change.
• Use a CIDR range only when you know exactly which addresses it covers.
• Limit the list to trusted networks that have a business need for access.
• Coordinate changes with network, security, and integration owners.

Troubleshoot IP allowlist access

Frequently asked questions