IP access control now applies across the web app, REST API, external apps, and MCP. Right now it's all or nothing, there's no way to exclude just one of these. Ask: let admins turn IP access control on or off independently for each area, for example: mobile app REST API external apps MCP Why: some use cases, like mobile devices on cellular networks, can't reliably work within a fixed IP range. Right now the only workaround is disabling IP access control entirely, which weakens security everywhere else just to accommodate one surface.