IP Restriction

The IP Restriction feature allows businesses to limit access to MyTime’s web and mobile apps based on a user’s network. By whitelisting specific IP addresses or domain names, businesses can control who can access or edit information in MyTime. This is especially useful for ensuring that access is restricted to in-store or authorized networks.

Things to know:

• This feature requires the hidden setting "Allow editing Authorized IPs". To activate it, contact MyTime Support at support@mytime.com. 
• Once enabled by Support, entering an IP address into the Authorized IPs (comma-separated) field reveals the setting: "Allow viewing but not editing information when outside of authorized IPs". This configuration offers two security levels:
  • Restricted Access (Setting Disabled): Staff can only view and edit data while connected to an authorized IP address.
  • View-Only Access (Setting Enabled): Staff can view data from unauthorized IP addresses, but any write or save actions are blocked.
• Account vs. Franchise Impact: This setting is applied at the account level and affects all locations within that account.
  • Parent Accounts: If enabled at the parent level, it applies only to parent-level staff.
  • Child Accounts: If enabled for a specific child account (e.g., Child A), it only affects locations under that account and will not impact other child accounts (e.g., Child B).
  • Restrictions are active for everyone by default.
• Only users with "Assign Roles" access control permissions can disable these restrictions for others.
• Static vs. Dynamic IPs:
  • Static IPs: These remain constant and are highly recommended for the most stable experience. You can request a static public IP from your Internet Service Provider (ISP), such as Google Fiber or Comcast.

  • Dynamic IPs: These change frequently. While MyTime will attempt to automatically whitelist a new dynamic IP within 5 minutes of a change, you may still need to update your IP list periodically.

  • We recommend that you use a static public IP address for best results. Contact your Internet Service Provider (ISP) to request one:
    • Google Fiber: https://support.google.com/fiber/answer/6032604?hl=en
    • Comcast: https://business.comcast.com/support/article/internet/using-a-static-ip

• Tools and Support:

  • Verify Your IP: Visit whatismyipaddress.com to find your current public IP address.

  • FQDN Support: In addition to standard IP addresses, MyTime supports whitelisting via Fully Qualified Domain Name (FQDN), which is ideal if you use a Dynamic DNS service.

  • Caching Note: IPs tied to a domain name are cached for 5 minutes; please allow this time for any updates to take effect.
    

• If IP restriction rules are enabled while a staff member is logged in from an unapproved IP address, any attempt to perform an action will be blocked immediately with the following error message: "Unable to perform action at this location" To regain access, the staff member must connect from an approved IP address and refresh their session. 
  

Contents: 

• Setting Up Allowed IPS
• Viewing Information Outside of Authorized IPs 
• Enforce IP Restrictions

Setting Up Allowed IPS

Once the hidden setting has been enabled by the MyTime team, follow these steps to configure your network access:

1. Navigate to Business Setup > Settings
2. Locate the IP restriction fields:
   • Authorized IPs: Enter your static IP addresses, separated by commas
   • Authorized FQDNs: Enter your domain names, separated by commas. This is useful for dynamic IP setups and allows you to restrict access to MyTime even if you don't have a static IP address. To create a dynamic DNS, visit: https://my.noip.com/dynamic-dns.
3. Click Save

Viewing Information Outside of Authorized IPs 

You can allow users to view the system without the ability to make changes when they are on an unauthorized network. This restriction applies to all actions, including clocking in/out and editing client files. 

To enable this:

1. Go to Business Setup > Settings
2. Enable “Allow viewing but not editing information when outside of authorized IPs”
3. Save 

Example: A staff member can view the schedule from home but cannot edit appointments. If they attempt to make a change, they will receive the error: "There was an error: You are not authorized to perform this action from this location."

Enforce IP Restrictions

By default, MyTime enforces IP restrictions for all staff members once your addresses are configured. However, you can exempt specific individuals from these rules.

Things to know:

• IP restrictions are enforced for all staff by default
• Only users with the Assign Roles access control permission can disable IP restrictions for other staff members

To disable IP restrictions for a specific staff member:

1. Navigate to Business Setup > Staff & Availability
2. Open the desired staff member's profile
3. Uncheck the "Enforce IP Restriction" checkbox
4. Click Save

If you have any questions, please contact our support team at support@mytime.com.

Related Articles

IP Verification for Staff Logins

IP Verification vs. Multi-Factor Authentication (MFA)