# Office network attendance

Accept attendance from approved office internet connections using the network address received by your server.

Enable the **Office Network Attendance** add-on and grant **Manage office networks for attendance** to the people maintaining it. The server checks the connection address itself; employees cannot type an address to pass the check.

## Add the office connection

1. Open **Attendance → Office networks**.
2. If you are at the office, inspect **Your current connection** and choose **Add this address**. Otherwise choose **Add office network**.
3. Name the network and enter its IP addresses or CIDR ranges.
4. Add notes identifying the connection or provider, then save.

For a hosted or cloud server, use the office's public address; private ranges are refused in hosted workspaces. A static public address avoids refusals when the provider changes the connection's address. For a server inside the office network, use the internal range the server actually sees.

IPv4 and IPv6 are supported. Ranges broader than /16 for IPv4 or /32 for IPv6 are refused. If the server is behind a trusted proxy or load balancer, the administrator must configure `TRUSTED_PROXIES` correctly so the application sees the employee's address; see [Configure and initialize](https://czappstudio.com/docs/installation/configuration).

## Apply the attendance rule

In [attendance policies](https://czappstudio.com/docs/administration/attendance), add **On an office network** and choose the approved networks. Test a check-in from the office and from an outside connection before rolling out the policy.

Phones using mobile data will not match the office connection. Ask staff to join the office Wi-Fi or provide a suitable alternative such as [Geofence attendance](https://czappstudio.com/docs/modules/geofence-attendance). A network rule verifies the connection, so use your own network access controls and combine checks when appropriate.

## Maintain and troubleshoot

Refused attempts record the source address. Compare it with the saved network to identify a changed public address, mobile-data connection or proxy configuration issue. Never add a broad range merely to make a refusal disappear.

Remove a network from attendance policies before deactivating or deleting it. Retest whenever the internet provider, proxy or office network changes.