DocumentationExperience Cloud KCS

AEM preview returns 403 due to IP allowlist configuration

Last update: June 20, 2026

Preview environments in AEM reject requests with 403 errors when the IP allow list blocks traffic. The default preview allow list blocks all IPs or incorrect entries deny access. Removing or correcting the allow list restores preview access.

Description description

Environment

  • Adobe Experience Manager as a Cloud Service (AEMaaCS)
  • AEM as Cloud Service - Sites
  • Adobe Experience Manager On-Premise Software

Issue/Symptoms

  • HTTP 403 response with message Error 403 Not allowed. Not allowed.
  • Response header shows deny-reason=preview_whitelist_ip_generated.
  • CDN logs show rejected client IP due to allow list rule.
  • Preview endpoint using one domain works while another fails.
  • Access is restored after modifying or removing allow list entries.

Root cause

The preview service is created with a default IP allow list that blocks all traffic. Requests are denied when this list remains active or when incorrect entries such as invalid CIDR ranges or conflicting rules block valid client IPs.

Resolution resolution

To resolve this issue, follow these steps:

  1. Access the failing preview URL and inspect the response headers.

  2. Verify the presence of x-aem-debug: deny-reason=preview_whitelist_ip_generated and confirm the response shows HTTP 403.

  3. Navigate to Cloud Manager > Program > Environments > select the environment > IP Allow Lists and review which lists are applied.

  4. Check if Preview Default [ envId] is still applied.

  5. Unapply the allow list labeled Preview Default [ envId] .

  6. Reload the preview URL and verify that it loads or shows a different error.

  7. Review all IP/CIDR entries and remove invalid entries such as 0.0.0.0/32.

  8. Replace invalid ranges with correct IP ranges required for access.

  9. Create and apply a new IP allow list that includes only the required IP ranges such as office VPN public IPs.

  10. Confirm the new allow list is active in Cloud Manager.

  11. Remove any conflicting or legacy allow lists that are not intended for preview, including lists reused from author or publish environments. Verify only required lists remain.

  12. Test the preview dispatcher endpoint, typically in .net format, and compare it with the CDN endpoint in .com format.

  13. Confirm that once the allow list is corrected, both endpoints behave consistently.

  14. Re-test preview access by opening the preview URL in a browser or running the following command and confirming the response does not return 403:

    curl -I https://preview-<env>.adobeaemcloud.com

recommendation-more-help
experience-cloud-kcs-help-kbarticles