How to Configure Google Workspace Context-Aware Access based on IP Subnets

The Limitations of Passwords

In a standard Google Workspace deployment, security relies primarily on passwords and 2-Step Verification (2FA). While 2FA is excellent at stopping remote phishing attacks, it fails to address physical security and location-based threats. For example, if your company strictly prohibits remote work, an employee should not be able to log into Google Drive from a coffee shop in another country, even if they possess the correct password and the 2FA token.

To enforce geographic and network-based boundaries, Google Workspace utilizes Context-Aware Access (CAA). CAA evaluates the context of the login attempt—specifically the source IP address—before it even asks for a password. By creating an IP Subnet policy, you can build a mathematical geofence around your physical office, guaranteeing that your corporate data is completely inaccessible from the public internet.

Step 1: Defining the Corporate IP Range

First, you must teach Google Workspace the exact public IP addresses of your corporate office’s internet connection.

1. Log into the Google Workspace Admin Console as a Super Administrator.
2. Navigate to Security > Access and data control > Context-Aware Access.
3. Click on Access levels, and then click Create Access Level.
4. Name the access level: Corporate-Office-Network-Only.
5. In the conditions builder, click Add Attribute and select IP Subnet.
6. Enter the public IP address of your office firewall using CIDR notation. (e.g., if your office has a single static IP, enter 198.51.100.45/32. If you have a block of IPs, enter 198.51.100.0/24).
7. Click Save.

(Note: Do not enter internal LAN IPs like 192.168.x.x, as Google only sees the public NAT address).

Step 2: Binding the Policy to High-Risk Apps

You have defined what the “Corporate Network” is, but you haven’t applied it to anything. You must bind this policy to specific Google applications.

1. Return to the main Context-Aware Access dashboard.
2. Click Assign Access Levels.
3. On the left side, select the Organizational Unit (OU) containing your employees (e.g., Finance Department).
4. You will see a list of Google applications. Locate Google Drive and Docs and click Assign.
5. Check the box next to the Corporate-Office-Network-Only policy you just created.
6. Click Save.

The Power of Exception Routing

A common mistake IT administrators make is applying IP restrictions globally to the root OU. If you do this, you will instantly lock out the CEO who is traveling, and you will lock yourself out of the Admin Console if you try to work from home to fix it.

CAA allows for elegant exceptions using Organizational Units or Google Groups.

• The Exception Group: Create a Google Group named CAA-Bypass-Remote-Workers. In the Context-Aware Access dashboard, instead of selecting an OU on the left, select Groups, find this group, and assign it a “No Access Level” policy. Anyone placed in this group is exempt from the strict IP rules.
• Granular App Control: You can apply the strict IP policy to Google Drive (preventing file downloads outside the office), but leave Gmail unrestricted, allowing traveling employees to still answer emails on their phones via cellular networks.

The Zero Trust Experience

The policy takes effect within minutes. If an employee is sitting at their desk inside the physical office, their computer routes out through the 198.51.100.45 firewall. Google sees the matching IP and lets them into Google Drive seamlessly.

If that same employee goes home, connects to their home Wi-Fi, and tries to open drive.google.com, Google’s BeyondCorp engine intercepts the request. It compares the home Wi-Fi IP address against the policy, realizes it is not authorized, and immediately throws a red “Access Denied by Corporate Policy” screen, effectively neutralizing the threat of remote data exfiltration.