Restricting login access strictly to company IP / On-premises network (SaaS Hosted)

Yes, you can restrict by IP on the IP Filter tab of the Users screen.  Note that to add this for all users it may be faster to use an import scenario.

Hi, you can also use the Advanced Authentification feature.

The integration of Acumatica ERP with Microsoft Active Directory Federation Services (AD FS) provides centralized user and access management (by using Active Directory) and single sign-on (SSO) for your domain users. With this integration in place, users of Acumatica ERP can access the instance with their domain credentials.

Attention:This functionality is available only if the Active Directory and Other External SSO feature is enabled on the Enable/Disable Features form.

@Ariyair Both replies can get you there. They just put the network rule in different places.

josborn02's IP Filter tab on Users (SM201010) is checked by Acumatica itself at sign-in, so you don't need IIS or the hosting firewall. On 2026 R1 it's per user only. There's no company-wide or role-level setting, and a user with no rows can sign in from anywhere, so every new user needs rows too. Ranges are compared octet by octet, not as one number, so keep each row inside one block (203.0.113.10 to 203.0.113.20) and add a row per block. It also runs on API logins, so an integration user needs the integration's addresses in its rows, or no rows at all.

To find the right address, open Access History (SM201045) and read the IP Address on a recent Login row from the office. A blocked attempt shows up there as Login Failed with "The IP address is out of range." and the address it rejected.

Eric's AD FS route puts the rule on your own server instead of the hosted one. An AD FS access control policy on the Acumatica relying party can permit sign-in only from a specific network or IP range. On a hosted site there are two catches. The Acumatica side of SSO usually means a web.config change, so your hosting partner does that part. Each employee also needs Forbid Login with Password checked on their user record, or they can skip AD FS and sign in with a password. Acumatica's IP filter still runs on AD FS sign-ins, so you can use both.

Whichever you start with, test on one user and keep one admin account unrestricted until it works.