Skip to main content
IP Access Control allows you to restrict access to the Honeydew application and API to specific IP addresses or ranges, providing an additional layer of security for your organization.

​
Overview

IP Access Control is a security feature that enables organizations to:
  • Restrict access to Honeydew to specific IP addresses or ranges
  • Enhance security by preventing unauthorized access from unknown locations
  • Comply with corporate security policies and regulatory requirements
  • Protect against potential security threats from unauthorized IP addresses
IP Access Control is recommended for organizations that require additional security measures beyond standard authentication methods like SSO and API keys.

​
How It Works

When your organization has IP rules:
  1. Access Validation: Requests over the supported access methods are checked against your denylist, and against your allowlist unless your organization exempts SSO users
  2. Blocked Requests: Requests from unauthorized IP addresses are automatically blocked
  3. Audit Trail: All access attempts (both successful and blocked) are logged for security monitoring
  4. Real-time Enforcement: Rules take effect immediately

​
Supported Access Methods

IP Access Control applies to these methods of accessing Honeydew:
  • Web Application: Browser-based access to the Honeydew interface
  • API Access: All API endpoints including GraphQL API
  • JDBC Proxy: Connections from BI tools and other integrations
  • XMLA Interface: Connections from Excel
  • MCP Server: AI assistants and agents connected through the Honeydew MCP server
  • Snowflake Native App: Access through the Snowflake Native Application

​
IP Address Formats

Honeydew supports the following IP address formats for access control:

​
Single IP Addresses

​
IP Address Ranges (CIDR Notation)

​
Multiple IP Addresses/Ranges

Add each IP or range as its own rule, or paste a list (see Adding Rules).

​
Setup Instructions

IP Access Control is available on the Enterprise plan.
Admins manage IP restrictions in Settings → IP restrictions. The page has two lists:
  • Allowlist: when it has rules, only IPs matching an enabled rule are granted access. Without allowlist rules, every IP that the denylist does not match is allowed.
  • Denylist: IPs matching a rule are always denied access.
The same IP or range cannot appear in both lists.

​
Adding Rules

  1. Collect the IP addresses or ranges that need access, covering every location and service that connects to Honeydew.
  2. Add each rule to the allowlist or the denylist as a single IP or CIDR range with a description, or paste a comma- or newline-separated list to add several at once.
  3. Save. Rules take effect immediately.
An update that would block the IP you are connecting from is rejected, so you cannot lock yourself out. The check covers only your own IP, so include every location your other admins work from in the first allowlist update.

​
Changing Rules

Edit a rule to change its range or description, or disable it to keep it without enforcing it. At least one allowlist rule must remain enabled while the allowlist has rules. Clear all removes every rule and turns IP restrictions off.

​
Common Use Cases

​
Corporate Office Access

Restrict access to your corporate office IP ranges:

​
Remote Work with VPN

Allow access from your corporate VPN:

​
Cloud Infrastructure

Allow the static egress IP of services you run in your cloud account:

​
Shared and SaaS Services

Avoid adding the IP ranges of a shared cloud or SaaS service, such as a cloud region or a hosted AI assistant, to the allowlist. Every customer of that service uses the same addresses, so the allowlist admits all of them. Instead, route the traffic through a static IP that your organization owns, and allowlist only that IP. For example, use a NAT gateway with a reserved IP, such as AWS NAT Gateway, Google Cloud NAT, or Azure NAT Gateway, or a forward proxy. For a hosted AI assistant that connects to the Honeydew MCP server over OAuth with SSO, such as Claude.ai or Claude Desktop, you can also exempt SSO users from the allowlist.

​
Exempting SSO Users from the Allowlist

Your organization can opt in to exempt users who signed in through its own enterprise SSO connection from the allowlist. The exemption is off by default. To turn it on, enable Users signed in with your organization’s SSO can bypass the allowlist under the allowlist in Settings → IP restrictions. The switch needs at least one allowlist rule. With the exemption on:
  • The denylist and every other check, such as MFA and role permissions, still apply.
  • Other sign-in methods, such as username and password, remain limited to the allowlist.
  • API keys are never exempt, including the API keys of SSO users.

​
Integration with Other Security Features

IP Access Control works in conjunction with other Honeydew security features:

​
Authentication Methods

  • SSO: IP restrictions apply to SSO users, unless your organization exempts them from the allowlist
  • API Keys: API key access is also restricted by IP address
  • MFA: Multi-factor authentication is still required for authorized IP addresses

​
Audit and Compliance

  • Access Logs: All IP-based access attempts are logged
  • Compliance Reports: IP access data can be included in compliance reporting
  • Security Monitoring: Integrate with your existing security monitoring tools

​
Support

For questions or issues related to IP Access Control, please reach out to support@honeydew.ai