Keywords: IP whitelisting, security, IP address, IP range, CIDR, whitelist, unauthorized login, bypass, IT admin, login history, access control
Summary
This article covers the IP Whitelisting security feature in Cloud 9, which allows IT administrators to control which IP addresses can access your Cloud 9 URL. It walks through setup, managing IP entries, bypassing for specific employees, and reviewing unauthorized login attempts.
Overview
IP Whitelisting is a security feature in Cloud 9 that gives IT administrators control over which IP addresses are permitted to log into your Cloud 9 URL. When enabled, any login attempt from an IP address that is not on the whitelist will be automatically blocked and the user will see an error message directing them to contact their office administrator.
This feature is useful for practices that want to prevent unauthorized access from unknown locations, reduce exposure to malicious login attempts, and maintain centralized control over who can access Cloud 9 and from where.
Note: Enabling IP Whitelisting affects all users at your URL. Before activating any IP restrictions, make sure all necessary IP addresses have been added and confirmed with your local IT team. It is recommended to activate restrictions outside of business hours to avoid disrupting the practice.
How to Enable IP Whitelisting
IP Whitelisting must be activated by Cloud 9 Support before it will be available in your Cloud 9 URL. Contact Cloud 9 Support to request activation. Once it is enabled on the back end, you can proceed with the setup steps below.
Setting Up the IP Whitelisting Permission
Once Cloud 9 Support has enabled the feature, an employee with the Edit Employees permission must assign the IP Whitelisting permission to the employee who will be managing the whitelist.
- Navigate to Edit > Setup > Employees.
- Select the employee and open their profile.
- In the Permissions section, find and check IP Whitelisting.
- Save the changes.
Note: You may need to log out and back into Cloud 9 after the permission is applied for it to take effect. If the option is still not showing, clear your cache and cookies and log in again. See the Cloud 9: Clearing Cache and Cookies article for instructions.
Managing the IP Whitelist
Once the permission is applied, navigate to Edit > Practice Information > Security tab to access the IP Whitelisting management screen.
Note: Accessing Practice Information requires the Edit Practice Information employee permission.
Step 1: Access the IP Whitelisting Section
Once in the Security tab you will see the section labeled IP Whitelisting. This is where all IP entries are managed.
Step 2: Add an Entry
Click the blue Add Entry button to add an IP address or range.
Note: For detailed questions about which IP format your practice uses or how your network is configured, contact your local IT team. They will be best positioned to advise on the correct entries for your setup.
Supported IP Formats:
- Single IP: A single specific IP address. Use this when you want to allow one exact IP address.
- CIDR Notation: A block of IP addresses your practice uses. Use this when you want to allow an entire block of addresses.
- IP Range: A range of IP addresses you want to allow without including the entire block.
- Wildcard: A format entered by local IT that allows every IP address within that wildcard pattern.
Each format has an example outlined in the Supported Formats window within the Add Entry dialogue for reference.
Step 3: Complete the Entry Fields
Once you click Add Entry a box will appear with the following fields:
Step 3a: IP Address/Range
Enter the IP address, block, range, or wildcard in the IP Address/Range field. The format guide displayed beneath the IP Whitelisting header shows the correct format for each type. Make sure the format matches exactly or you will receive an error.
Step 3b: Description
Enter a name or label for this entry in the Description field. This can be anything that helps identify the entry, such as “Office Network,” “Doctor Home IP,” or an individual employee’s name. This makes it easy to identify entries in the list later.
Step 3c: Save
Once the IP address and description are entered, click Save. If the format is incorrect, an error message will appear showing what the correct format should be so you can correct it before saving.
Step 3d: Confirm the Entry
Once saved, the entry will appear in the list. The Actions column will now show Edit and Delete instead of Save and Cancel. Note that the entry will be marked as Inactive when first saved. It must be activated before it takes effect.
Step 4: Activate the IP Entry
To put the rule into effect, change the status to Active using the Status dropdown for that entry.
A confirmation dialogue will appear warning you that activating this restriction will immediately prevent any users not within the whitelisted IP ranges from logging in on their next session. Click Activate IP Restriction to confirm.
Important: Because activation takes effect immediately, it is strongly recommended to wait until the office is closed before activating restrictions. Have your local IT team add and confirm all applicable IP addresses before activating to make sure it does not affect the practice during business hours.
Step 5: Deactivating an IP Entry (Optional)
If an IP address or range is no longer needed, navigate back to Edit > Practice Information > Security tab. Locate the entry and change its status to Inactive using the Status dropdown.
A confirmation dialogue will appear warning you that you are deactivating an IP restriction. Click Deactivate IP Restriction to confirm. This deactivates only the selected rule and does not affect any other entries on the whitelist.
Unauthorized Login Attempts
When a user attempts to log in from an IP address that is not on the whitelist and does not have a bypass enabled, they will see the following error message:
“Unauthorized Login due to security policy. Please contact your office administrator for assistance with your login settings.”
Reviewing Login History and Audit Logs
Login History
To view unauthorized login attempts you will need the View Login History permission applied in your employee profile. Once applied, navigate to View > Login History to see a log of all login attempts including unauthorized ones. Each entry in the Login History shows:
- Login Name
- Employee Name
- Date and Time
- Computer ID
- Computer IP
- Result: Failure (if the login did not go through)
- Reason: IP Not Whitelisted (if the failure was due to IP Whitelisting)
System Logs
All changes made to the IP Whitelist are tracked in the Cloud 9 System Logs. If you need to identify which employee made a change to the whitelist, contact Cloud 9 Support and we can check the System Logs on your behalf.
Note: System Logs are only available for the last 90 days. Changes made more than 90 days ago will not be retrievable.
Bypassing IP Whitelisting for Specific Employees
There may be employees who need access to Cloud 9 from locations outside the whitelisted IP ranges, such as a doctor accessing the system from home or an employee who works remotely or travels. You can bypass IP Whitelisting for a specific employee or an entire employee type.
For a Single Employee:
- Navigate to Edit > Setup > Employees and select the employee.
- Above the Permissions section, check the Bypass IP Whitelisting box.
- Click Save.
If it does not take effect immediately, have the employee clear their cache and cookies, close and relaunch the browser after checking for an update, and log in again.
For an Entire Employee Type:
- Navigate to Edit > Setup > Employee Types and select the Employee Type.
- Click Edit.
- Above the permissions section, check the Bypass IP Whitelisting box.
- Confirm the permissions are correct and click Push to Employees.
- A confirmation dialogue will appear. Click Push to Employees to confirm.
- Click the green Save button to save the changes.
Once this is set at the Employee Type level, any new employees created under that type will automatically have Bypass IP Whitelisting enabled unless it is manually unchecked when creating their profile.
As always, if you have any further questions please do not hesitate to reach out to Cloud 9 Support by emailing us at cloud9support@planetdds.com, or chatting us online using the chat bubble on the lower right at https://cloud9support.planetdds.com/hc/en-us, or giving us a call during our business hours of 8:00 AM EST to 8:00 PM EST at the 1.800.394.6050 option 2.