Teams and enterprise
Restricted access
Enterprise controls on who can use your team's Brunel workspace and from where. Required GitHub organization, IPv4 and IPv6 allowlists, maximum session length and signing everyone out.
Restricted access is available on Enterprise, set by the team's owner or admins in Enterprise → Security and SSO. Every change needs a sign-in from the last two hours and is written to the audit log.
Required GitHub organization
Only members of the named GitHub organization can join the team or sign in to it. Membership is checked with GitHub at sign-in.
IP allowlist
A list of IPv4 and IPv6 addresses and ranges in CIDR notation, for example:
203.0.113.0/24
198.51.100.7
2001:db8:1200::/40The allowlist applies to every request: pages, the API from the browser, and calls made with members' API keys. A request from another address gets policy_denied (HTTP 403).
Maximum session length
Between 1 and 720 hours. A member whose sign-in is older than that is asked to sign in again. Without a value, sessions last up to 30 days (and single sign-on sessions 12 hours).
Sign everyone out
Sign every member out ends every session of every member at once, and revokes their API keys. Use it when a device is lost or someone leaves in a hurry.
What members see
A member refused by a rule sees a page explaining which rule applies (organization, address, session age or single sign-on) and how to sign in again. Refusals are recorded in the security log.