Home > Tenant configuration > Review allowlists and web integrations

Review allowlists and web integrations

Cadence: Monthly

Subscription model: All

Roles: Tenant Admin (TA)

Last verified: 2026-09

Benefits:

• Aligns Qlik Cloud allowlist with current corporate firewall rules
• Detects orphaned web-integration entries from decommissioned embedded experiences
• Confirms IP policies still match acceptable-access boundaries

Goal

Allowlisted domains, web integrations (CORS), and IP policies (tenant-level IP allowlists) drift over time as new embedded experiences are deployed and old ones are retired. Monthly review confirms the allowlist still matches current network and embedded-app reality.

Tasks

Gotchas

• Native tenant-level IP allowlisting is available—enable it under IP allowlists in tenant settings, or manage it programmatically with the IP Policies API (requires the TenantAdmin role). When an allowlist is enabled, Qlik checks each connecting client's IP and blocks any address not on the list, so this—not web integrations—is the native way to restrict tenant access (including UI login) to a corporate IP range. Web integrations remain a separate control that covers CORS for embedded origins only. Two cautions: (1) allowlists are IPv4-only—if any users reach the tenant over IPv6, do not enable them or those users are blocked; (2) add your own IP before enabling to avoid locking yourself out (recovery requires a Qlik Support case). IdP conditional access and a forward / reverse proxy remain valid additional layers.
• Session timeouts are configurable by Tenant Admins in tenant settings. Session inactivity timeout: 15 min – 1,440 min (default 30 min). Maximum session duration: 1 h – 168 h (default 24 h). Tune these for embedded analytics, kiosk modes, or long-form workflows within those bounds.
• AWS PrivateLink to Qlik Cloud is now GA, supported from Direct Access gateway v1.8.0 (Sept 2026)—superseding the roadmap, not GA status recorded here as of May 2026. It still routes through the Direct Access gateway: it removes public-internet traversal for that traffic but doesn't eliminate the gateway from the architecture, and it is not a path to removing the gateway. Notable constraints: the gateway must be installed on an EC2 instance; Qlik must first confirm PrivateLink availability for your tenant/region and hand you the regional service name before you create the interface VPC endpoint; and it is not supported on Qlik Cloud Government or Qlik Cloud Government - DoD. Customers not yet on 1.8.0+ still need Direct Access over the public allowlisted endpoints as documented above.

References

• Allowlisting domains and IP addresses
• Managing IP allowlists—enable/configure native tenant-level IP restriction
• IP Policies API (qlik.dev changelog 186)—programmatic management of IP allowlisting rules
• Qlik APIs (qlik.dev)—IP policies and Web integrations REST APIs
• Allow access from list of IPs (community discussion)
• Configuring AWS PrivateLink for Qlik Data Gateway - Direct Access—GA setup guide, supported from gateway v1.8.0
• AWS PrivateLink to Qlik Cloud (superseded roadmap discussion)
• WebSocket connections via JWT fail with 403 (CSWSH protection)
• Unlock public data sharing with Qlik Cloud (anonymous access)

Tags: #monthly #tenant_configuration #allowlist #web_integrations #ip_policy #cors