DocumentationExperience Cloud KCS

Resolve 403 Access Denied errors after configuring Preview IP allow lists in AEM

Last update: October 30, 2026

Adobe Experience Manager as a Cloud Service (AEMaaCS) Preview may return 403 Not allowed errors when the client IP isn’t included in the active IP allow list or a default deny-all rule remains applied at the CDN layer. To resolve the issue, verify the CDN deny reason, Preview IP Allow List configuration, and actual client egress IPs, then update the allow list as needed and test access again.

Description description

Environment

Adobe Experience Manager as a Cloud Service (AEMaaCS) (QA, Stage, Production environments)

Issue/Symptoms

  • After adding specific IP addresses to the Preview IP Allow List in Cloud Manager for QA, Stage, and Production environments, attempts to access the Preview service still return 403 Not allowed errors.

  • The response includes:

    code language-none 
    HTTP/1.1 403 Not allowed
x-aem-debug: deny-reason=preview_whitelist_ip_generated

  • No corresponding entries for the denied requests appear in the Preview Dispatcher access logs.

  • Successful requests from other IPs are visible in the logs, but affected requests aren’t.

  • The issue persists after confirming that the IPs are added to the allow list.

Root cause

AEM Cloud Preview environments enforce IP allow lists at the CDN (edge) layer. If the client IP isn’t included in the active allow list, or if a default deny-all rule remains applied, the CDN blocks the request with a 403 error before it reaches Dispatcher or AEM. The deny-reason=preview_whitelist_ip_generated header in the response confirms this condition.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Confirm the deny reason at the CDN layer:

    1. Use a tool such as curl to access the Preview URL with debug headers: curl -I -H 'x-aem-debug: edge=true' https://preview-<env>.adobeaemcloud.com/some/page.html
    2. Check for x-aem-debug: deny-reason=preview_whitelist_ip_generated in the response headers. This confirms that the IP allow list configuration at the CDN is blocking the request.

  2. Verify the Preview IP Allow List configuration in Cloud Manager:

    1. In Cloud Manager, go to Services > IP Allow Lists.
    2. Identify the allow lists bound to the Preview environments.
    3. Ensure that the correct client IP address or CIDR range is included and that there are no conflicting entries or typos.
    4. Ensure that the Preview Default deny-all list isn’t still applied alongside the custom allow list.

  3. Confirm the actual client egress IPs:

    • Have affected individuals visit a public IP checker, such as ifconfig.me, to determine their current public IP address.
    • If they’re behind a VPN, SWG, or corporate proxy, ensure that the egress IP is the address being allowlisted.
    • Compare these IPs with the CIDRs in the Preview IP Allow List.

  4. Update the allow list as needed:

    • Add the specific client IP or a broader CIDR block that covers all expected egress IPs.
    • Remove or unbind any default deny-all lists if present.

  5. Test access again:

    • Run the curl command again or retry access.
    • When correctly configured, the response should no longer include deny-reason=preview_whitelist_ip_generated, and the request should reach Dispatcher/AEM, resulting in a 200, 302, or 404 response.
recommendation-more-help
experience-cloud-kcs-help-kbarticles