14 Basic Context-Aware Access (IP/geo)

Caveats

• CAA evaluates Google apps continuously after access is granted, but third-party SAML apps are checked only at sign-in, and it does not revoke an issued OAuth token — so pair it with session length (№12) and OAuth sweeps (№39).
• IP and geo are attributes, not identity — a VPN endpoint in the permitted region satisfies them. This is just a friction control.
• Requires Enterprise Standard+, Education Standard+, Frontline Standard+, Enterprise Essentials Plus or Cloud Identity Premium — on lower editions the screen is absent.

Setup steps

1. 1. Create a basic access level using the Basic (not Advanced/CEL) editor, gating on IP range and/or geographic region.
   open ↗

   

   https://admin.google.com/ac/security/context-aware/access-levels · captured 2026-07-15

   Security › Access and data control › Context-Aware Access › Access levels

   Access level 'corp-ip-geo'

   IP subnet in <office/VPN egress CIDRs> OR Region in <permitted countries>

   condition

   Meets attributes

2. 2. Create a second, tighter access level for the admin cohort (used later by the privileged access workstation, №53, and deny-by-default gating, №49).
   open ↗

   

   https://admin.google.com/ac/security/context-aware · captured 2026-07-15

   Security › Access and data control › Context-Aware Access › Access levels

   Access level 'admin-only'

   IP subnet in <PAW egress> only

3. 3. Assign the access level to the target apps and OU (organizational unit) in Monitor mode first, then read Reporting > Audit and investigation > Context Aware Access log events for would-be-blocked events before enforcing.

   Security › Access and data control › Context-Aware Access › Assign access levels

   App

   Gmail/Drive/Admin console

   OU

   <target>

   Access level

   corp-ip-geo

   Mode

   Monitor, then Active

4. 4. Flip to enforcement only after the monitor pass is clean, and keep the break-glass account (№19) out of the enforced OU.

   Security › Access and data control › Context-Aware Access

   Mode = Active (enforce); break-glass OU excluded

Ongoing maintenance

• requires a human On office/VPN changes: update the CIDR list before the move.

How to verify

1. Sign in as a test user through a VPN egress outside the allowed set — the sign-in should be blocked (or logged as would-block while still in Monitor).

2. Read the CAA audit log for Access Denied events to confirm the level evaluates at all.