Staff Access and IP Restrictions
Pixie CRM guidance. Follow the route for your workspace, check your role and enabled modules, and verify the result before moving on.
Understand the separate roles of staff permissions, authentication controls and network access restrictions before changing access to Pixie CRM.
Start with identity and permissions
Staff accounts and roles determine which actions a person may perform after sign-in. Review those controls before considering a network restriction. Use individual accounts, appropriate permissions and the supported authentication settings. An allowed IP address does not establish who is using an account and should not replace identity checks.
Confirm where a restriction is enforced
An IP rule may be implemented by a hosting service, reverse proxy, VPN or a supported application control. This guide does not claim that every Pixie CRM workspace includes a staff IP-allowlist screen. Confirm the available mechanism with the responsible administrator and verify how trusted proxies affect the address the application receives.
Plan access continuity before a change
Office connections, remote workers and mobile networks can use changing addresses. A restriction can lock out legitimate staff or administrative recovery access if those cases are overlooked. Document the intended audience, the administrator’s recovery route and a controlled test before deployment. Verify denied access as well as authorised access.
Checks before you finish
- Identify the enforcement point and responsible administrator.
- Account for remote work, dynamic addresses and trusted proxies.
- Test permitted and denied access with a documented recovery route.