Because you need to know who is logging in before you know what IP policy to enforce, no?