IP restrictions for RDP
Beyond who signs in, you can also restrict from where — per resource.
How it works
Section titled “How it works”Add IPs or CIDR ranges (e.g. 203.0.113.10, 198.51.100.0/24) to the resource’s IP restriction list. RDP sign-ins are then only accepted from those sources; an RDP attempt from anywhere else is denied — before any factor is even asked.
- Applies to RDP only. Console sign-ins are physical/local and carry no meaningful source IP.
- Empty list = no restriction (RDP allowed from anywhere, subject to MFA as usual).
- IPv4 addresses and ranges are supported. When a list is set, clients that can’t be matched are refused.
When to use it
Section titled “When to use it”- Office or VPN egress is fixed → allow only those ranges.
- A server should only ever be reached from a jump host → allow just that host.
- Roaming users with changing IPs → leave the list empty and rely on MFA; that’s exactly what MFA is for.
- Denials appear in the audit log with a clear reason, so a legitimate user hitting the restriction is easy to spot.
- If the machine sits behind a gateway or NAT, remember the observed client address may be the intermediary’s — verify what your sign-in events actually show before tightening the list.
- This is a complement to MFA, not a substitute: an allowlisted network can still contain a compromised device.