This page provides information about using mobile devices with access levels.
Overview
Access Context Manager supports using Google basic mobile management and advanced mobile management to create access levels that check for certain characteristics of mobile devices.
For iOS and Android devices, Access Context Manager can accept or reject requests based on the following:
Whether screen lock is enabled.
Whether storage on the device is encrypted.
Whether the device is owned by your enterprise.
Whether the device has been approved by an administrator.
Whether the OS version running on the device is compatible.
Because Access Context Manager relies on MDM, the minimum device requirements for basic and advanced management apply.
Limitations
This section describes the limitations of mobile device support in Access Context Manager.
Request origin
Access levels that check mobile device attributes permit access only if the following applies:
The request originates from Safari or Google Chrome.
The request comes from a user account in your organization.
If a request from a mobile device doesn't meet the preceding criteria, Access Context Manager denies the request, even if it meets the other requirements of the access level.
Enforcement delays
When you change settings for your managed mobile devices, it can take time for those changes to propagate. For example, if you modify your basic management settings to include a screen lock requirement, it can take up to 24 hours to propagate that change.
Although changes to access levels typically take effect within a few minutes, mobile device attributes might take longer to enforce while changes to your managed mobile device settings propagate.
Get started
To start using access levels to check mobile device attributes, do the following:
Set up basic mobile management or advanced mobile management for your organization.
This step requires access to the Google Admin console. To limit access to the console, you can grant administrator privileges specifically for mobile device management.
On your devices, sign in to Chrome using a corporate account.
For devices that should be permitted access to protected services, ensure requests originate from Safari or Chrome.
Create an access level that includes device policy attributes for your organization's mobile devices.