Beta: Create Context-Aware access levels

The first step in setting up Context-Aware access is to create access levels that combine conditions and values that define a user or device context. Access levels define the context within which users can access apps.

For example, you can create an access level for accessing Gmail that requires users to connect from a specific IP address range and require their devices to be encrypted.  

Let’s say that Mary is using Gmail on her laptop in the corporate office and then walks to a nearby coffee shop where she plans to continue using Gmail. Because her IP address changed, she won’t be able to access Gmail at the coffee shop if you specify that users connect to Gmail from a corporate IP address range.

Step 1: Set up endpoint verification

If you enforce a device policy in an access level, you and your users have to set up endpoint verification. You enable endpoint verification in the Admin console.

Chrome Browser, the endpoint verification extension, and a native helper app (Mac and Windows only) must be installed on the computers you want to monitor.

Turn on endpoint verification

  1. Turn on Endpoint verification in the Admin console.
  2. Deploy the Chrome endpoint verification extension to company computers or tell your Mac and Windows users to manually install it from the Chrome Web Store.
  3. From the Admin console home page, go to Device Management>Endpoint management.
    You see a list of devices with the Chrome Endpoint Verification extension.

Upload your device inventory of company-owned devices

If you plan to enforce a device policy that requires company-owned devices, Google needs a list of serial numbers for your company-owned devices.

Follow the instructions in “Add devices to your inventory.” under “Manage your inventory” in Inventory company-owned devices. You’ll see how to get a  list of company-owned devices and how to add devices to the list.

Step 2: Create an access level

Make sure Context-Aware Access is on

  1. Sign in to your super administrator account or as a delegated admin with these privileges:
    • Security>Security Settings
    • Services>Service Settings
    • Context Aware Access>Access level management
    • Context Aware Access>Access level enforcement
    See Create custom administrator roles.
  2. From the Admin console home page, go to Security>Context-Aware Access.
  3. Verify Context-Aware Access is “ON for everyone”. If not, click Turn On.
Define access levels 
Access levels consist of one or more conditions that you define and which users must meet to access apps. Access level conditions contain attributes you can select, such as device policy, IP subnet, or another access level.
  1. Select Access levels.
    You see a list of defined access levels. Access levels are a shared resource between G Suite and Google Cloud Platform so you might see access levels you didn’t create in the list.
  2. On the top right, select Create access level.
  3. Specify if the access levels apply when users:
    • Meet these conditions—Users must meet all conditions.
    • Don’t meet these conditions—Users don’t meet any of the conditions.
      This option specifies the inverse (or blacklisting) of the condition and is most frequently used for IP subnet attributes. For example, if you specify an IP subnet and “don’t meet,” only users with IP addresses outside of the specified range will match the condition. 
  4. Add attributes to the access level condition.
    Attribute Options
    IP subnet IPv4 or IPv6 address or a routing prefix in CIDR block notation
    Device policy Select one or more device policy options:
      Device password required (yes, no)
      Device encryption (not supported, not encrypted, encrypted)
      Windows policy (minimum OS version)
      Mac OS policy (minimum OS version)

    Chrome OS policy (minimum platform version)
    Settings>About Chrome OS>
    Detailed Build information>Platform
    example: 11151.113.0


    Verified Chrome OS (required, not required)
    If required, the Chrome device must be enrolled and have verified access.


    Company-owned device (required, not required)
    See “Upload your device inventory of company-owned devices” in step 1.
    If required, the Chrome device must be enrolled.

    Access level An existing access level
  5. To add another condition to the access level, click Add condition and add attributes to it.
  6. Indicate the conditions users must meet:
    • And—Users must meet the first condition and the added conditions.
    • Or—Users must meet only one of the conditions.
  7. When you’ve finished adding access level conditions, save the access level definition by selecting Create Access Level on the bottom right.

What's next: assign access levels to apps