Use case: Managed Chrome browser enforcement

This example shows you how to create a Context-Aware Access level to support a managed Chrome browser policy for your enterprise, and then assign this policy to apps.

Note: We recommend that if you are a Workspace-only user, do not add or modify Context-Aware Access access levels using the Google Cloud Platform (GCP) console. Doing so can cause this error: Unsupported attributes are being used on Google Workspace and blocked users.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAccess and data controlContext-Aware Access.
3. Select Access levels.
4. Click Create access level.
5. Add an access level name (for this example, a name like Managed Chrome browser) and an optional description.
6. Select Meet attributes. This means that users must satisfy the attributes in the condition to be able to access apps.
7. Click Add Attribute to create an access level condition.
8. Click Advanced mode. In this mode, you build your custom access level in an editing window using using Common Expressions Language (CEL). Go to  Create Context-Aware access levels, Define access levels - Advanced mode for details.
9. Add the code for the access level:
   device.chrome.management_state == ChromeManagementState.CHROME_MANAGEMENT_STATE_BROWSER_MANAGED && device.chrome.versionAtLeast("94.0.4606.81").
10. Click Save. Now you can assign this access level to apps.
11. Click Assign to apps. This link appears right after you create an access level. If you want to assign the access level later, navigate to SecurityAccess and data controlContext-Aware Access, and select Assign Access levels.
12. Select an organizational unit. The users in this organizational unit are the users who have access to the apps you specify, and at the level defined in the access level you created. For example, select HR to give access to a group of Human Resources users.
13. Choose apps for users to access. For example, Drive and Docs, Gmail, and Google Chat. 
14. Click Assign. You may have to scroll to see the Assign button for the app you want. Be sure to assign the access level to the correct app. Be sure not to assign the access level to the Admin console.
15. Select the access level to use. In this case, Managed Chrome browser.
    You can select more than one access level, if you need to. Users are granted access to the app when they meet the conditions specified in just one of the access levels you select (it’s a logical OR of the access levels in the list).
    If you want users to meet the conditions in more than one access level (a logical AND of access levels),create an access level that contains multiple access levels.
    Note: Leave the Apply to Google desktop and mobile apps box checked. 
16. Click Save. Note that if an access level is assigned to an organizational unit or group with a large number of users, it can take up to 24 hours for the access level assignment to show up.
17. To ensure proper assignment, look for:
    • A grey spot next to organizational unit name.
    • The name of the access level listed for the app.
18. To customize the messages users get when app access is blocked, navigate to SecurityAccess and data controlContext-Aware Access and click User message. User messages include:
    • Remediation messages—These messages are system generated, and correspond to the specific policy violation that blocked the user. Remediation messages present remediation options to the user so they can unblock their app access.
    • Custom messages—Messages you add that offer specific help for the user, such as additional advice on getting unblocked or a helpful link to click.
    • Default message—An example default message is: Your organization's policy is blocking access to this app. This message displays if you have not specified a remediation message or a custom message.
      Go to Allow users to unblock apps with remediation messages in Context-Aware Access for details.