Exercise 4: Manage access policies

Exercise directions

Step 1

If you’re not already signed in, sign in to your domain as the Administrator at admin.google.com.

Step 2

From the main menu, navigate to Security, then select Access and data control, and then click Context-Aware Access.

Step 3

Select Access levels.

Step 4

Click CREATE ACCESS LEVEL.

Step 5

In the Access level name text box, enter Device requirements.

Step 6

Under the Conditions section, ensure the Basic tab is selected and click Add Attribute.

Step 7

From the Select attribute dropdown that appears, select Device OS.

Step 8

In the Select OS menu, check the box for macOS.

Step 9

Click Add Attribute again within the same condition block.

Note: To require either macOS or iOS, ensure the operator at the top of the condition block is set to Meet any of the following attributes (OR).

Step 10

In the new attribute row, select Device OS.

Step 11

In the Select OS menu, check the box for iOS.

Step 12

Click SAVE. Your access level is now defined.

Step 13

On the confirmation screen or from the main Context-Aware Access page, click Assign to apps.

Step 14

Locate Google Vault in the list of apps. Select the checkbox next to it and click Assign (located at the top of the list or in the row actions). 

Step 15

In the panel that appears, select the Device requirements access level you just created.

Step 16

Click CONTINUE.

Step 17

Under Policy settings, verify that the enforcement setting is active (e.g., ensuring users are blocked if levels aren't met).

Step 18

Click CONTINUE to move to the review stage.

Step 19

Review your configuration and click FINISH or ASSIGN.

Step 20

Go back to the Context-Aware Access page, and click User message.

Step 21

In the Custom message field, enter the following:

Your device does not meet our requirement of being an iOS or macOS device.

Step 22

Click SAVE.