Control access to private content in a workspace

Access control gives you another level of security, making sure users meet requirements to access your workspace and any private content.

You can only set up two-step verification and require allowlisted IP addresses for private repositories, wikis, issue trackers, and snippets. You cannot manage public content through Access controls.

Restricted content

Repository source code and Git data are restricted. Any metadata, such pull request titles, comments, repository name is not necessarily restricted.

To find the Access control settings:

1. From your profile avatar, select the workspace or All workspaces for a full list.

2. Select the Settings cog on the top navigation bar.

3. Select Workspace settings from the Settings dropdown menu.

4. Select Access controls from the left navigation bar.

Requiring two-step verification

You can require that the users with access to private repositories or other private content are only able to see the content if they've enabled two-step verification. If they haven't enabled two-step verification, users with access will see a message that prompts them to enable it. In addition to being unable to see this content, users won't be able to clone, push, or pull a private repository either.

To require two-step verification for access to private content:

1. From the Access controls page, select the Require two-step verification option.

2. Click Update to save your changes.

Allowlisting IP addresses

You can require that users with access to private repositories or other private content are only able to see the content from certain IP addresses. If they aren't accessing from allowlisted IP addresses, users will see a message explaining why they have no access. In addition to being unable to see this content, users won't be able to clone, push, or pull a private repository either.

You can add IP addresses or network blocks for a set of IP addresses to an allowlist. If you are adding an individual IP address to an allowlist, we support IPv4 and IPv6. If you're entering a network block, we support CIDR notation, which is a standard for specifying a block of IP addresses. Refer to this CIDR notation section on Wikipedia for more details about how to use CIDR notation.

Here's some examples of values that you can add:

To add IP addresses to an allowlist for access to private content:

1. From the Access controls page, select the Restrict access to certain IP addresses option.

2. Click Add or remove IP addresses. A popup opens.

3. Enter an IP address or a network block for a set of IP addresses.

4.  Click Save to close the Add or remove IP addresses popup.

5.  Click Update to save your changes.