Is IP whitelisting per user, per repository, or global (not sure if this applies) for Premium plan?

[paul_nerie_1902]

We are using free accounts and are considering getting the Premium Plan specifically for restricting access by IP addresses.

Based on info I've seen so far, it's per repository, but I am not sure. Specially that there is no trial for the premium plan to check this.

Our requirement is that some users will be using a specific IP address, while others are not restricted.

My question is that is how flexible is is this IP restriction? Can it be set per user?

Is it set at the repository? 

Or is it a global setting for all users in our organization? Not sure if this is possible though.

If the setting is indeed per repository, would it be a problem that some users (developers) of the repository will be restricted by IP while others (project managers) are not?

Thanks in advance!

[Prince Nyeche · Accepted solution]

Hi @paul_nerie_1902 

Welcome to community! IP whitelisting feature for premium plan is done on an IP or IP range basis per application in your organization as it uses CIDR notation. So if you configure an IP, only that IP will be allowed to access the application. 

[paul_nerie_1902]

Thank you for response, but I'm afraid it does not clarify things. 

What is an 'application'? Are this GIT clients (commercial or software apps) used by an organization?

Does that mean then that I cannot restrict access for browsers? Any user can log in from any IP address using browsers?

The primary concern is that some users must not be able to access any repository from unauthorized locations. Based on this:

https://support.atlassian.com/bitbucket-cloud/docs/control-access-to-your-private-content/

It mentions two-step verifications (which I assume is browser log in and not API calls) and IP whitelisting per repository.

However I need to clarify this, hence my questions.

Thanks again!

[Prince Nyeche]

Hi,

"Application" meaning the Atlassian app used per organization. In your case bitbucket as a whole. However within the concept of cloud, it would basically mean any project(s) / repos you have within your bitbucket organization account and not necessary towards bitbucket application. The link you sent I believe speaks more on permission settings. You can always demo a premium plan if you really want to know what it does. 2FA features just controls how the user logs in after entering their email and password for additional authentication which can be enforced on an organization level with premium plans.

You cannot restrict browsers per say, it only restricts the IP address. I'm not sure there's any particular use case for browser specific restrictions.

Therefore if your primary concern is accessing your repo from a particular location, then whitelisting specific IPs is what it does and nothing more. This is what is shown when you add a whitelisted IP. Any other IP address  access will see the below message when they access your project(s).

[paul_nerie_1902]

Thanks again!

I must have misread about not having a trial, or have confused that with self-managed solution.

However when I try to upgrade, there is no mention that it is a trial period. I wouldn't mind spending USD 6.00 to try it out, but if there is a trial period, it would be nice to know.

Maybe it would be nice to have the premium features available to free plan, but the user cannot save settings. So users can actually see what they can get.

Anyway since the application is Bitbucket as a whole, then I suppose this is a global setting? 

IP whitelisting is not set per repository so I cannot have different sets of whitelisted IP per repository?

[Prince Nyeche]

Yes its global, you can't have IP whitelisting on a set of repos and it's not available for free plans. Having a demo of premium plan means reaching out to Atlassian and requesting for one if you're really certain you want to make a purchase. Atlassian access on the other hand comes with the trial of 30 days. However for premium which uses this feature, the application you're using should either be upgraded to standard plan then request for a demo for premium or you upgrade and downgrade after a set duration (your bill being prorated for you). Please reach out to Atlassian product advocates about this and how they can actually help you test this feature.

[paul_nerie_1902]

I guess that answers my questions :).

Thank you very much for your time!