Context-aware access controls are available for Gemini Enterprise

Context-aware access controls are available for Gemini Enterprise in the Admin console

To help organizations elevate their security posture, we are introducing context-aware access (CAA) policies in the Admin console for Gemini Enterprise. Google Workspace administrators can select granular security attributes for Gemini Enterprise access, including device security and location settings that can be applied to personal and managed devices.

For example, an administrator can create a CAA policy that restricts access to Gemini Enterprise from specific geographic regions. Organizations can also reuse their existing policies that apply to Workspace apps by also applying them to Gemini Enterprise.

Context-Aware Access settings for Gemini Enterprise in Admin console

Getting started

Admins: Context-Aware Access for Gemini Enterprise can be configured at the organizational unit (OU) or group level. Visit the Help Center to learn more about Context-Aware Access, creating Context-Aware Access levels, and assigning Context-Aware Access levels to apps.
End users: If enabled by your admin, you can access Gemini Enterprise when authenticating using your Google sign-in. If your organization’s Context-Aware Access settings are not set to allow access, you may see a message letting you know that you cannot use Google sign-in to authenticate with Gemini Enterprise, or you may see remediation messages which will provide some options on how to unblock Gemini Enterprise.

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on September 8, 2026, with expected completion by September 15, 2026

Availability

Enterprise: Enterprise Standard, and Plus
Education: Education Standard, and Plus
Other: Frontline Standard and Plus; Enterprise Essentials Plus; Cloud Identity Premium

Note: You will need to have purchased Gemini Enterprise to apply Context-Aware Access policies for your users.

Resources

Google Workspace Admin Help: Assign Context-Aware Access levels to apps
Google Workspace Admin Help: Protect your business with Context-Aware Access

Context-aware access controls are available for Gemini Enterprise in the Admin console

Google Workspace administrators can now use Context-Aware Access (CAA) policies to secure Gemini Enterprise directly within the Google Workspace Admin console. This rollout allows organizations to enforce granular, context-based security attributes to control how and where users interact with the enterprise AI portal. [1]

Key Capabilities of CAA for Gemini Enterprise

Granular Security Controls: Admins can define access criteria based on specific contextual attributes like device compliance status, IP address, and geographic region. For example, you can block access to Gemini Enterprise entirely if a user tries to connect from an unmanaged personal laptop or a high-risk geographic location. [1, 2]
Policy Reuse: If your organization already has robust CAA rules established for standard Workspace apps (like Google Drive or Gmail), you can seamlessly reuse and extend those existing policies to Gemini Enterprise. [1]
Targeted Deployment: Rules can be assigned and customized at the Organizational Unit (OU) or group level. This allows for stricter restrictions on departments handling sensitive data while remaining flexible for others. [1]

What End-Users See

If an employee fails to meet the defined security attributes (e.g., trying to log in via an unauthorized network), they will see a remediation or blocking message. This message informs them that they cannot use their Google sign-in for Gemini Enterprise and can provide actionable steps on how to fix the issue to unblock access. [1]

To get started with configuring these security boundaries, administrators can navigate to the Context-Aware Access section under the Security tab in the Google Workspace Admin Console.