Skip to content

SCAL-333737 #529

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rani2655 merged 2 commits into from
Aug 31, 2026
Merged

SCAL-333737 #529

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6c85211
SCAL-333737
rani2655 Aug 21, 2026
d4de62f
swarnima's feedback
rani2655 Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions modules/ROOT/pages/security-settings.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,49 @@ To avoid this issue, ThoughtSpot recommends the following:
* If you are using a ThoughtSpot Cloud instance, set up your instance to the same domain as your host application. For more information, see link:https://docs.thoughtspot.com/cloud/latest/custom-domains[Custom domain configuration, window=_blank].
* If you are using authentication methods that rely on cookies, xref:_enable_partitioned_cookies[enable partitioned cookies].

[#network-access-requirements]
== Network access requirements

If your organization uses a firewall or Content Delivery Network (CDN) with domain-level access controls, you must allowlist the following domains before provisioning a new ThoughtSpot cluster or modifying an existing firewall configuration. Without access to the critical domains, ThoughtSpot will not load.

[NOTE]
====
Contact your network administrator to apply these allowlist rules. ThoughtSpot does not manage your organization's firewall or CDN configuration.
====

=== Critical domains

Allowlist the following domains to ensure ThoughtSpot loads correctly. If any of these are blocked, ThoughtSpot will not function.

[options="header",cols="2,3"]
|===
|Domain |Purpose
|`+*.thoughtspot.cloud+` |ThoughtSpot application and APIs
|`+*.thoughtspotartifacts.cloud+` |Static assets and build artifacts
|`+*.thoughtspotlogin.cloud+` |Authentication and login flows
|`+ok14static.oktacdn.com+` |Okta authentication assets
|`+*.cloudfront.net+` |CDN-served ThoughtSpot resources
|`+cdn.skypack.dev+` |JavaScript module delivery
|`+cdn.jsdelivr.net+` |Open-source library assets
|`+cdnjs.cloudflare.com+` |Open-source library assets
|`+code.jquery.com+` |jQuery library
|===

=== Optional domains

The following domains support third-party services that ThoughtSpot uses for product analytics, in-app guidance, customer support, and content delivery. Allowlist these domains to ensure these services load correctly within your ThoughtSpot instance.

[options="header",cols="2,3"]
|===
|Domain |Feature
|`+cdn.mxpnl.com+` |Mixpanel product analytics
|`+app.pendo.io+` |Pendo in-app guidance
|`+cdn.pendo.io+` |Pendo in-app guidance
|`+fonts.googleapis.com+` |Google Fonts
|`+js.intercomcdn.com+` |Intercom in-app support
|`+fast.wistia.com+` |Wistia embedded video content
|===

== Configure security settings

Users with administration privileges can configure security settings on the Security settings page of the ThoughtSpot UI, or by sending a request to the `POST /api/rest/2.0/system/security-settings/configure` API endpoint. Note that the following settings on the **Security Settings** page will appear as locked for ThoughtSpot Analytics application users and will require an embedding license:
Expand Down