Network policy is a rule set that limits which IP addresses, subnets, VPNs, or geographic network ranges can reach a cloud account, console, API, or database. In practice, it acts like a network allowlist: even if someone knows a valid username and password, the service can reject the login or data request if it comes from an untrusted source.
This matters because cloud breaches often start with valid credentials or stolen sessions, not with a software exploit. Network policy helps reduce that risk by shrinking the set of places from which an account can be used, making credential theft less useful and unusual access easier to spot. Defenders pair it with MFA, federated identity, and logging to catch sign-ins that come from unexpected networks. Attackers often try to bypass it by using corporate VPNs, proxy infrastructure, or cloud-hosted relays that appear to come from approved ranges.