IP access control now applies across the web app, REST API, external apps, and MCP. Right now it's all or nothing, there's no way to exclude just one of these.
Ask: let admins turn IP access control on or off independently for each area, for example:
mobile app
REST API
external apps
MCP
Why: some use cases, like mobile devices on cellular networks, can't reliably work within a fixed IP range. Right now the only workaround is disabling IP access control entirely, which weakens security everywhere else just to accommodate one surface.