# Tenant Access Restrictions

Contact Nexthink Support to restrict access to your Nexthink tenants/environments by:

* [#restricting-ip-ranges](#restricting-ip-ranges "mention")
* [#disabling-local-accounts](#disabling-local-accounts "mention")

## Restricting IP

Restrict access to your Nexthink tenant(s) for specific IP ranges. This way, only authorized networks can reach your Nexthink environments.

To enable IP restriction, contact Nexthink Support to specify the allowed IP ranges.

{% hint style="info" %}
Even for enforced IP restrictions, Nexthink may retain access for technical and support purposes.
{% endhint %}

## Disabling local accounts

Disable all local (non-SSO) user [accounts](https://docs.nexthink.com/platform/user-guide/administration/account-management/accounts) to revoke access to their corresponding Nexthink tenant. You have available the following options:

* Disable all local accounts except the initial `admin` account—which is kept active.
* Disable all local accounts, including the initial `admin` account.

To request local account deactivation, contact Nexthink Support for assistance.

{% hint style="warning" %}
You cannot disable a single user account; you can just request the deactivation of all accounts at once.

Keep in mind that disabled local accounts can only be reactivated by contacting Nexthink Support.
{% endhint %}