How to Configure Context-Aware Access Policies in Google Workspace

Beyond the Password

Historically, securing a corporate network meant securing the perimeter. If an employee had the correct username and password, they were granted access to their email and files. However, in the modern era of remote work and Zero Trust architecture, simply knowing a password is no longer sufficient proof of identity.

If an employee’s credentials are stolen, a hacker in a foreign country can log into their Google Workspace account and download confidential company data. To prevent this, system administrators must implement Context-Aware Access (CAA) Policies.

CAA policies evaluate the context of a login attempt, not just the password. You can configure Google Workspace to completely deny access to Gmail and Google Drive if the login attempt originates from an IP address outside your corporate VPN, if it comes from an unmanaged personal smartphone, or if it originates from a country where you do not have operations.

Step 1: Define an Access Level

Before you can block access to an application, you must first define a specific condition (an Access Level).

1. Log into the Google Workspace Admin Console.
2. Navigate to Security > Access and data control > Context-Aware Access.
3. Click on Access levels.
4. Click Create Access Level.
5. Name the level (e.g., Corporate Network Only).
6. Under conditions, select IP subnet.
7. Enter the public IP address or CIDR block of your corporate headquarters (e.g., 198.51.100.0/24).
8. Click Save.

You have now created a logical definition for your physical office building.

Step 2: Assign the Policy to an Application

Now you must bind that Access Level to a specific Google service, such as Google Drive, and target a specific group of users.

1. Return to the main Context-Aware Access menu.
2. Click on Assign policies.
3. On the left side of the screen, select the Organizational Unit (OU) you wish to restrict (e.g., “Finance Department”).
4. In the main window, you will see a list of all Google Workspace apps. Hover over Google Drive and Docs and click Assign.
5. A side panel will appear showing all your created Access Levels. Check the box next to Corporate Network Only.
6. Click Save.

The User Experience

The policy enforces instantly. If a user in the Finance OU attempts to open Google Drive from their desk inside the corporate office, the system verifies their IP address against the CAA policy and seamlessly grants them access.

However, if that same user goes home, opens their personal laptop, and attempts to log into Google Drive without first connecting to the corporate VPN, Google intercepts the login sequence. Even if the user enters the correct password and completes the 2FA push notification, the screen will display a stark “Access Denied” message stating that the organization’s policy prevents access from this location.