User passwords are notoriously weak and can be cracked quite easily. Also, we do not want the entire world to be able to look at our ERP which only a handful of our employees need to access. Security and availability/performance are compromised when we allow access from all devices on the entire globe as it becomes potentially easy for malicious persons to create performance issues by carrying out denial of service and other attacks.

So we need a way to be able to allow access only when the user is trying to login from certain devices and not from any device across the world.

Such a restriction will prevent hackers from attacking via ddos or other methods and will also prevent brute force and other hacks.