Network access
This page lists the domains and IP address ranges that you must allow to reach the ApplySG Backoffice Portal. It is for users of endpoint devices, such as COMET and Government Standard Image Build (GSIB) devices, and for network administrators who set firewall rules. The Backoffice Portal is reachable over the Internet and over the Government Encrypted Network (GEN).
User access: If you reach the Backoffice Portal through a virtual private network (VPN), you do not need to allow any addresses.
Backoffice Portal addresses
Ask your agency’s firewall manager (AFM) to allow the entries for your network and environment.
| Network | Environment | Domain or IP address range |
|---|---|---|
| Internet | Staging | app-stg.backoffice.apply.gov.sgauth-stg.auth.apply.gov.sg |
| Internet | Production | backoffice.apply.gov.sgauth.apply.gov.sg |
| GEN | Staging | 10.219.159.0/25 |
| GEN | Production | 10.209.81.0/25 |
Other domains to allow
Depending on your sign-in method and environment, you may also need to allow:
| Item | When it applies |
|---|---|
| TechPass | Sign in with TechPass. |
| WOG Entra ID | Sign in with WoG Entra ID. |
| Amazon Cognito | Staging only. It protects the lower environment. |
Constraints and limitations
| Constraint | Detail |
|---|---|
| VPN | Users on a VPN need no firewall changes. |
| Environments | Staging and production use different addresses. |
Related content
- Login methods: which sign-in methods need which domains.
- Portal links and environments: the portal addresses.
