14 Basic Context-Aware Access (IP/geo)

Caveats

• Enforcing an access level on the Admin console can lock every admin out¹
• CAA evaluates Google apps continuously after access is granted, but third-party SAML apps are…²
• IP and geo are attributes, not identity³
• Requires Enterprise Standard+, Education Standard+, Frontline Standard+, Enterprise Essentials Plus…⁴

Setup steps

1. open ↗

   

   https://admin.google.com/ac/security/context-aware/access-levels · captured 2026-07-15

   Security › Access and data control › Context-Aware Access › Access levels ↗

   Create a basic access level using the Basic (not Advanced/CEL) editor, gating on IP range and/or geographic region.

   Access level 'corp-ip-geo'

   IP subnet in <office/VPN egress CIDRs> OR Region in <permitted countries>

   condition

   Meets attributes

   Create Context-Aware access levels ↗

2. open ↗

   

   https://admin.google.com/ac/security/context-aware · captured 2026-07-15

   Security › Access and data control › Context-Aware Access › Access levels ↗

   Create a second, tighter access level for the admin cohort (used later by the privileged access workstation, №51, and deny-by-default gating, №47).

   Access level 'admin-only'

   IP subnet in <PAW egress> only

   Create Context-Aware access levels ↗

3. Security › Access and data control › Context-Aware Access › Assign access levels ↗

   Assign the access level to the target apps and OU (organizational unit) in Monitor mode first, then read Reporting > Audit and investigation > Context Aware Access log events for would-be-blocked events before enforcing.

   App

   Gmail/Drive/Admin console

   OU

   <target>

   Access level

   corp-ip-geo

   Mode

   Monitor, then Active

   Assign Context-Aware Access levels to apps ↗

4. Security › Access and data control › Context-Aware Access ↗

   Flip to enforcement only after the monitor pass is clean, and keep the break-glass account (№20) out of the enforced OU.

   Mode = Active (enforce); break-glass OU excluded

   Assign Context-Aware access levels to the Admin console ↗

Ongoing maintenance

• requires a human On office/VPN changes: update the CIDR list before the move.

How to verify

1. Sign in as a test user through a VPN egress outside the allowed set — the sign-in should be blocked (or logged as would-block while still in Monitor).

2. Read the CAA audit log for Access Denied events to confirm the level evaluates at all.