Restrict Zoho Mail access based on IP address 

Zoho Mail is a secure email service that offers an IP Restriction system with which you can restrict login access to users who are not part of the specified IP range. This is useful when an organization wants to provide secure controlled access to Zoho Mail only from certain authorized locations. For example, if an organization wants its employees to access mail only from the organization premises in their corporate network, then such organizations can add IP restrictions for their users.

You can restrict access to the whole organization, for specific users, or based on the user roles—Super Admin, Admin, and User. Once you define the allowed IP addresses, the respective users will not be able to access their mail account from any other IP addresses other than the ones defined.

User-based IP Restriction

You can define a range of IP addresses for every single user added in the Admin Console in the Allowed IP section of a user's Security settings. To define allowed IP addresses for a specific user,

1. Login to Zoho Mail Admin Console
2. Navigate to Users in the left pane and click on the user you want to restrict access based on IP addresses.
3. On the Users page, click Security from the top menu.
4. On the Security page, navigate to Allowed IP addresses.
5. Enter the IP range you would like the user to have access to using the From IP Address and To IP Address section.
6. Once done, click the Add button.
   
7. You can delete a configured IP address by using the Delete icon on the right side of the configured IP addresses.
   ​
    

You can add multiple allowed IP addresses by following the same steps.

Role-based IP Restriction

You can define allowed IP addresses for users based on their role. For example, you might want all your admins and super-admins to operate only from your corporate network but don't want to restrict access of general users. In such cases, to configure role-based IP restriction,

1. Login to Zoho Mail Admin Console
2. Navigate to Security and Compliance in the left pane.
3. Go to security and click Allowed IP Addresses
   
4. Under the Allowed IP addresses section, navigate to the role for which you would like to restrict access from the top menu.
   • All - The Allowed IP addresses will be applicable to all the users part of the organization.
   • Super Admin -  The Allowed IP addresses will be applicable only to the Super Admin of the organization.
   • Admin - The Allowed IP addresses will be applicable only to the Admins of the organization.
   • User - The Allowed IP addresses will be applicable to the Users (who are not Admins or Super Admins) of the organization.
5. Click the Add button and enter the From IP Address and To IP Address in the pop-up.
6. Once done, click Add.
   ​

You can add multiple allowed IP addresses by following the same steps for users under different roles.

Policy-based IP Restriction

If you want to apply IP Restriction to a set of users who do not share the same role, you can do so with Access Restrictions under Email Policy. To add allowed IP addresses for a Access Restriction,

1. Login to Zoho Mail Admin Console
2. Navigate to Mail Settings in the left pane. 
3. Under Email Policy, navigate to Access Restrictions.
4. Select the Restriction you would like to edit and navigate to the Allowed IP Addresses section.
5. Enter the From IP Address and To IP Address along with a description for future references.
6. Once done, click the   icon.
   ​

You can add multiple allowed IP addresses by following the same steps for any existing or new Access Restriction.