Security Optional feature

Workspace-wide access control. You can configure it from global nav > Workspace settings > Security. Only a Workspace Owner can change it (Workspace permissions). You can configure IP access control and multi-factor authentication control.

For an individual account's own login methods (password, Google login, MFA registration), see Login and security.

TIP

This is an optional feature. Depending on your contract, it might not be available.

IP access control

Limits workspace access to allowed IP addresses or CIDR ranges only.

Setup

1. Open global nav > Workspace settings > Security.
2. Turn on Enable IP Access control.
3. To apply this to guests as well, turn on Include guests.
4. Enter the allowed IPs in Allowed IP address.

Supported formats

Allowed IP address accepts the following formats:

• A single IP address (for example, 203.0.113.15)
• CIDR notation (for example, 192.168.1.0/24)
• Both IPv4 and IPv6
• Multiple IP addresses or ranges

When you enter values, your current IP address appears as a suggestion.

Scope

• Access to resources in the workspace while signed in is in scope. Reports are also in scope.
• Turning on Include guests also applies this to guests.
• Public links and signed embeds aren't affected.
• For CLI, MCP, Slack, and routines, see Checks by access method.

Notes

• Changed settings apply immediately to users who newly sign in. For users who are already signed in, it can take some time to take effect.
• You must be accessing from at least one of the allowed IPs when you save.
• Networks that support both IPv4 and IPv6 may use IPv6 to connect. Include the IPv6 address or CIDR used for the connection in the allowlist as well.

If you lose access

If incorrect IP restrictions lock you out, contact Codatum support.

Multi-factor authentication control

Requires multi-factor authentication for password logins.

Setup

1. Open global nav > Workspace settings > Security.
2. Turn on Require Multi-factor authentication.
3. To apply this to guests as well, turn on Include guests.

Specifications

• Password login is in scope. Google login and SSO sign-in aren't affected.
• Turning on Include guests also applies this to guests.
• For MFA registration on the account side, see Login and security.
• For CLI, MCP, Slack, and routines, see Checks by access method.

Checks by access method

The timing of IP access control and multi-factor authentication checks depends on how you access Codatum.

Access method	IP access control	Multi-factor authentication
Browser	Checked when you open the workspace or refresh authentication during use.	Checked when you open the workspace or refresh authentication during use.
CLI and PATs	Checked on every request. Not checked for service account PATs.	Checked when you approve CLI login in the browser or issue a PAT.
MCP clients	Checked when you approve the connection in the browser.	Checked when you approve the connection in the browser.
AI agent requests from Slack	Checked when you approve access to the target workspace in the browser.	Checked when you approve access to the target workspace in the browser.
Automatic routine runs	Not checked at execution time.	Not checked at execution time.

Enabling IP access control or multi-factor authentication does not require approved MCP connections or Slack links to be approved again. For existing Slack links, see Access control when linking Slack.

PATs issued before multi-factor authentication became required do not require approval again. IP access control applies to users' existing PATs on every request.

Existing routines continue to run as the Run permission account after settings change. To stop access or automatic runs, use the controls for each feature.

Target	How to stop it
MCP clients	Disconnect the connection or disable its MCP access profile.
AI agent requests from Slack	Turn off permission to start the agent from Slack for the workspace.
CLI and PATs	Suspend or revoke the PAT.
Routines	Disable the routine.