cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
nashcoop
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 1 of 2

Can MWG rules restrict access to Google apps

We would like to restrict access to some Google apps so our employees can only access those apps within our Google Workspace tenant. For instance, can we have a MWG rule that blocks Google Drive for personal Gmail accounts, but allow access to Google drive that's managed by our Google tenant?

1 Reply
AaronT
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: Can MWG rules restrict access to Google apps

Below are two rulesets we have - one to get the Google Tenant domain and one to restrict access to domains.  You could leverage this (we don't block on Google Tenants) as a baseline.  You'd put the domains you want to alllow (domains of the user logging in, so if you require a user to login as user[at]yourdomain.com, you'd add yourdomain.com in the list).  You can see there's a couple other options (consumer accounts, authenticated accounts only, etc).  Hopefully this helps you create what you need.

Please note the ruleset criteria too.

Google Tenant Visibility ruleset walk through:

First find the email address being used to login to accounts.google.com from the "google-accounts-signin" header, or from the signin form POST request

Extract the domain using a string commands in the SWG.  This is stored in the User-Defined variable called "Tenant ID"

 

In the Google Tenant Restrictions:

Set a user-defined variable "GoogleAllowedDomains" as a comma separated list of allowed domains for logging in

Allow consumer accounts should be allowed if you want consumer accounts (I believe gmail.com is an example)

Allow Google services connecting to gserviceaccounts.com to be allowed

If the list of domains allowed is false, then remove the header "X-GoogApps-Allowed-Domains" values and add it with the list of allowed domains.

 

Hope this helps as a starting point

 
 

 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use our Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from product experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by employees.
Join the Community
Join the Community