Security
Access Control
IP Whitelist and login methods (OAuth/SSO) — Configuration and operation
Enneo provides two independent mechanisms for controlling system access: a network-based IP whitelist and an identity-based configuration of the permitted login methods. Both mechanisms operate at different levels and can be combined.
IP Whitelist
The IP whitelist restricts access to enneo based on the network address of the requesting client. If this setting is active, all requests from users whose IP address is not contained in the list will be rejected.
The configuration can be found under
Advanced Settings → Data Protection → Access Control - IP Whitelist.
The setting accepts a list of IP addresses or CIDR ranges. Both IPv4 and IPv6 are supported.
["192.168.1.0/24", "10.0.0.5", "2001:db8::/32"]If the list is empty, access without IP restriction is possible. As soon as at least one entry is set, every request is checked — if there is a match, access is granted, otherwise it is denied.
Tip
When setting the IP whitelist, the system checks whether the own IP address of the configuring user is also included in the list. If this is not the case, the storage will be denied — as protection against accidental self-blocking.
Login Methods (OAuth / SSO)
Enneo supports multiple login methods, which can be configured per tenant.
The SSO configuration can be found at Advanced Settings → Single Sign-On.
Allowed Login Methods
The Authentication methods setting determines which login types are active:
| Value | Description |
|---|---|
microsoft | Microsoft Azure AD / Entra ID (OAuth2/OIDC) |
google | Google OAuth2 |
oauth | Generic OAuth2 provider (configurable) |
local | Local login with email and password |
Note
Users who were created exclusively via SSO cannot log in via
the local login — even if local is enabled.
Automatic user provisioning
The Automatic user provisioning setting defines for which email domains
enneo automatically creates new users when they first log in via SSO.
Enter the domains without @.
["example.com", "partner.org"]Info
Existing users are not affected — the check is only carried out when a new account is initially created via SSO. If the list is empty, enneo does not create any new users via SSO. Users must then be created beforehand, for example in the user profile.
Default role for auto-provisioned users
Under Default role for auto-provisioned users, you choose the role that automatically created users receive. If this is set to "None", the account is created, but an administrator must first assign a role in the user profile before the user has access.