Flexible Access vs. Fixed Access: how myAvail ETMS restricts access to your site at the network layer, and how to choose the right option for your organization.
NOTE: Both options control who can reach the site. Users still sign in with their normal myAvail ETMS credentials under either configuration.
Overview
myAvail ETMS supports two network access models. They differ in how access to the site is restricted at the network layer:
- Flexible: The application is reachable from any internet address. No IP restriction is applied.
- Fixed: The application is reachable only from IP addresses your organization has provided, which are allowlisted in an Azure Network Security Group (NSG). All other traffic is blocked.
Flexible Access
No source-IP restriction is placed on the NSG protecting the site, so any user with valid credentials can log in from any location or network: office, home, mobile, or otherwise.
Advantages
- No IP addresses to collect or maintain. Nothing for your team to set up.
- Remote and traveling staff are never blocked at the network layer.
- Simple onboarding for new users, contractors, or support staff.
Trade-offs
- The login page is reachable by anyone on the internet, increasing exposure to scanning, bots, and brute-force attempts.
- Access control relies entirely on application login rather than the network.
Fixed Access
The NSG protecting the site is configured with explicit allow rules for your organization's known external IP address(es). Traffic from any other address is denied before it reaches the application.
Advantages
- Adds a network-layer barrier. Unauthorized sources are blocked before they can attempt to log in.
- Substantially reduces exposure to internet-wide scanning and automated attacks.
- Supports compliance or security policies that require restricting access to known networks.
Trade-offs
- Requires you to provide your external IP address(es) in advance.
- Users on a non-allowlisted network (home, hotel Wi-Fi, a new office) are blocked until it is added.
- Any change in your IP address, or a new site, requires an NSG update before access is restored.
- Best suited to a small number of stable, known egress points, such as a data center or office with a static IP.
Comparison
| Attribute | Flexible | Fixed |
|---|---|---|
| Access control | Application login only | NSG allowlist + application login |
| Who can reach login page | Anyone on the internet | Only allowlisted IPs |
| Setup required | None | Customer supplies IP address(es) |
| Ongoing maintenance | None | Update NSG when IPs/sites change |
| Remote/traveling access | Always available | Blocked unless allowlisted |
| Exposure to scanning/bots | Higher | Substantially reduced |
| Best fit | Distributed or mobile workforce | Fixed offices/data centers with static IPs |
Choosing a Configuration
- Fixed access is a good fit if your staff connect from a known, stable set of locations. It adds meaningful protection for modest maintenance.
- Flexible access is a good fit if staff connect from many or changing locations.
- A hybrid approach is also possible: allowlist known fixed locations while leaving room to adjust as your footprint changes.
NOTE: Contact your account or support representative to discuss which configuration fits your organization, or to submit IP addresses for Fixed access.