Skip to main content
Danish
Apprentice
August 31, 2026

Can we deny access to certain assets based on source IPs ?

  • August 31, 2026
  • 2 replies
  • 11 views

We have a case where users connecting to VPN from outside the country get a specific pool/subnet of IPs when successfully connected to VPN. Now we have a case, that such users should not be able to access certain Assets/IPs. Can we have any kind of control for this. PAM can check what is the source IP and then do not allow access to restricted assets. Is this doable?

2 replies

GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
August 31, 2026

Not exactly what you are looking for but the Location Restriction feature may be of use. It is available in the Access Policy configuration to use to restrict what IP range can access the Access Policy. An Address Group would need to be set up to contain the IP addresses for the end users' systems (workstations) to be applied to the Access Policy. The location restriction is designed to restrict proxied sessions from any workstations not listed in the Address Group that is assigned to the Access Policy for Location Restriction.

DanishAuthor
Apprentice
August 31, 2026

Thank you for your response.

I tried testing the location restriction feature, and it works perfectly for assets that use local accounts. However, when we access the assets using domain accounts, the system automatically detects and applies a different policy because the domain accounts are linked to the assets.

Could you please advise how we can segregate the assets in this scenario so that the appropriate policy is applied when using domain accounts?

Badge Earners

Show all badges
Terms & ConditionsAccessibility statement