IP access control now applies across the web app, REST API, external apps, and MCP. Right now it's all or nothing, there's no way to exclude just one of these.

Ask: let admins turn IP access control on or off independently for each area, for example:

mobile app

REST API

external apps

MCP

Why: some use cases, like mobile devices on cellular networks, can't reliably work within a fixed IP range. Right now the only workaround is disabling IP access control entirely, which weakens security everywhere else just to accommodate one surface.