> ## Documentation Index > Fetch the complete documentation index at: https://docs-dev-feat-docs-5607-tenant-acl.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Tenant Access Control List > Manage network policies that control access to your tenant's Auth0 resources by using the Tenant Access Control List's configurable rules. The Tenant Access Control List (ACL) manages traffic to your tenant's resources based on rules you define. Using the Tenant ACL can help you conserve your rate limits against potential threats (like denial-of-service attacks) and ensure that only legitimate users access your applications. ## How it works Each Tenant ACL is composed of a set of rules. When your tenant or Management API receives a request, your Tenant ACL's rules determine how it responds. The Tenant ACL's granular configuration options let you apply rules to a variety of different signals and scopes. Some examples are: * You can use the [`hostnames` scope](./tenant-access-control-list/reference#param-hostnames) to disable or restrict access to your canonical domain while allowing traffic via custom domains. * If you are adopting Model Context Protocols (MCP) in your tenant, you can use the [Dynamic Client Registration (`dcr`) scope](./tenant-access-control-list/reference#param-dcr) to avoid risks like unauthorized application registration or phishing attempts via misleading application names. For monitoring and auditing, a [tenant log event](./tenant-access-control-list/tenant-log-event-reference) (`acls_summary`) is created every 10 minutes for each Tenant ACL rule with details of how that rule is affecting traffic. You can enable monitoring mode for rules to test and log how they would behave without actually applying the rule to traffic. ## Limitations * Customers on an Enterprise plan can create 1 Tenant ACL. * Customers on an Enterprise plan with the Attack Protection add-on can create up to 10 Tenant ACLs. * Each Tenant ACL can include up to 20 entries per source identifier (such as IPv4, CIDR, and more). * The **User Agent** identifier is not supported when using self-managed custom domains. * The `auth0-fowarded-for` header is not supported. | **Read...** | **To learn...** | | ----------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | | [Configure Tenant Access Control List Rules](/docs/secure/tenant-access-control-list/configure-rules) | How to configure rules to allow or block traffic by IP range, country, or other attributes. | | [Use Curated Blocklists](/docs/secure/tenant-access-control-list/use-curated-blocklists) | How to use Auth0-managed curated IP blocklists in Tenant ACL rules to automatically block known threats. | | [Enable Monitoring Mode](/docs/secure/tenant-access-control-list/enable-monitoring-mode) | How to audit how a rule would affect traffic without changing the Tenant ACL's current behavior. | | [Rule Evaluation](/docs/secure/tenant-access-control-list/rule-evaluation) | How the Tenant ACL's deterministic engine evaluates rule matches and execution. | | [Code Samples](/docs/secure/tenant-access-control-list/use-cases) | Code samples for common Tenant ACL use cases using the Management API, Auth0 SDKs and CLIs, and Terraform. | | [API Parameters](/docs/secure/tenant-access-control-list/reference) | Descriptions of all parameters for Tenant ACL endpoints in the Management API. | | [Tenant Log Events](/docs/secure/tenant-access-control-list/tenant-log-event-reference) | Descriptions of all fields for the Tenant ACL `acls_summary` tenant log event. |