Using the Login IP Allowlist with Broad or Dynamic IP Ranges

For the login IP allowlist to be effective, traffic that accesses your Marketing Cloud Engagement account must come from a stable IP range. If your organization uses the public cloud, dynamic infrastructure, or distributed networks, or if you have many remote employees, your users can access Marketing Cloud Engagement from a diverse range of IP addresses. In these situations, establish a stable egress path for your users before you turn on the login IP allowlist in blocking mode.

Use one of these recommended strategies to handle broad IP ranges when blocking mode is on:

• Static egress IP: Configure your cloud environment so that Marketing Cloud Engagement traffic exits through a static public IP, such as an Elastic IP.
• Dedicated egress proxy: Route traffic through a proxy or API gateway with a fixed public IP.
• Corporate VPN: Route traffic through your corporate VPN so that requests exit through a known, stable public IP range.
• Centralized cloud NAT or egress gateway: Consolidate outbound traffic from multiple cloud workloads behind a small set of static public IP addresses.
• Enterprise gateway: If API traffic passes through an API gateway, enterprise service bus, or integration gateway, configure it to use stable outbound IP addresses for Marketing Cloud Engagement traffic.
• Stable provider ranges: If your cloud or network provider has a predictable range of outbound addresses, add the smallest appropriate CIDR range to your allowlist. This solution is easier to maintain than a large list of individual addresses.