# Restrict perspective access base on IP

**URL:** <https://forum.inductiveautomation.com/t/restrict-perspective-access-base-on-ip/33294>\
**Category:** General Discussion\
**Created:** [March 21, 2020, 10:45pm UTC](https://forum.inductiveautomation.com/t/restrict-perspective-access-base-on-ip/33294 "2020-03-21T22:45:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![NII](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nii/32/12920_2.png) [@NII](https://forum.inductiveautomation.com/u/NII)\
**Post date:** [March 21, 2020, 10:45pm UTC](https://forum.inductiveautomation.com/t/restrict-perspective-access-base-on-ip/33294/1 "2020-03-21T22:45:54Z")

</div>

I would like to enable/disable control (ex. a button) based on client IP address. How would I accomplish this?

---

<div class="post-metadata">

**Author:** ![cmallonee](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/cmallonee/32/6416_2.png) [@cmallonee](https://forum.inductiveautomation.com/u/cmallonee)\
**Post date:** [March 23, 2020, 4:58am UTC](https://forum.inductiveautomation.com/t/restrict-perspective-access-base-on-ip/33294/2 "2020-03-23T04:58:30Z")

</div>

The best way I can think of is a little complicated, but it works.

1. Create a [Security Zone](https://docs.inductiveautomation.com/display/DOC80/Security+Zones) based on the IP ranges you want to ALLOW (I’ll call mine “VALIDIP”).
2. Create a [Security Level](https://docs.inductiveautomation.com/display/DOC80/Security+Levels) (I’ll call mine “valid\_ip”).
3. Modify the [Security Level Rules](https://docs.inductiveautomation.com/display/DOC80/Security+Level+Rules) within your Identity Provider, and use the expression language with the following expression (straight from the example in the documentation): `containsAny({security-zones}, 'VALIDIP')`
4. You now have three options:  
A: You can modify the security settings of the button to disable it if the security level required is not met.  
B. You can bind the visibility of the button to an expression which uses the security level (not very secure, but nice for removing buttons a user shouldn’t click.  
C. Do both A and B.