August 26, 2025
Context-Aware Access policies can now be applied to all internal and third-party apps using OpenID Connect
What’s changing
Admins can now apply Context-Aware Access (CAA) policies to apps which use OpenID Connect (OIDC), which are a subset of OAuth apps that are authenticated using Google sign-in. Admins can use a single setting to apply CAA policies to all OIDC apps by default. We are not providing per app access control for individual apps at this moment. The new OIDC setting can also be applied in monitor mode for admins to gauge potential end user impact before applying in active mode.
CAA creates granular access control security policies for apps based on attributes, such as user identity, location, device security status, and IP address, and they can be applied to users on personal and managed devices. Expanding CAA to encompass OIDC apps means admins can ensure their users are able to access or are blocked from accessing these apps according to the broader security parameters of their organizations.
Admins can configure CAA policies for OIDC apps in the Admin console under Security > Context-Aware Access > General settings
Getting started
- Admins: CAA for OIDC apps can be configured at the OU level. Visit the Help Center to learn more about context-aware access, creating context-aware access levels, and assigning access levels to third-party apps.
- End users: If enabled by your admin, you can access certain apps when authenticating using your Google sign-in. Or you may see a message letting you know that you cannot use Google sign-in to authenticate with certain apps or you may see remediation messages which will provide some options on how to unblock apps.
Rollout pace
- Rapid Release and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on August 26, 2025.
Availability
Available for Google Workspace:
- Frontline Standard and Plus
- Enterprise Standard and Plus
- Education Standard and Plus
- Enterprise Essentials Plus
- Also available for Cloud Identity Premium
Resources
- Google Workspace Admin Help: Context-Aware Access overview
- Google Workspace Admin Help: Create Context-Aware access levels
- Google Workspace Admin Help: Assign Context-Aware access levels to apps
- Google Workspace Admin Help: Context-Aware Access log events
- Google Workspace Admin Help: Allow users to unblock apps with remediation messages in Context Aware Access