Google Context-Aware Access - Windows Version Control?

[Shaun_Dark_Lord]

Hi

 

We've run a few reports to see what OS staff are using at home.  Unsurprisingly, there's a worrying number of out-of-support Windows 10 devices (10.0.19043 and older), along with a few Windows Vista - 8.1 devices.

 

Google has introduced "Context Aware Access" which should in theory allow us to set minimum OS version requirements for or Google domain users.

 

Has anyone played with this?  Any examples, tips or lessons you can share?

 

Thanks!

[StephenPink]

I've been trying to play with this and the new Security Advisor 

but not super impressed so far. 

As far as I can tell as well for Windows devices, it will only work IF the user is signed into Chrome, with the endpoint verification extension forced OR the actual device is managed by Google Workspace. 

I also can't seem to export the required asset info for CE at the moment - as I need make and model, and most of the device information seems to be missing the make... 

[Shaun_Dark_Lord]

15 hours ago, StephenPink said:

I've been trying to play with this and the new Security Advisor 

but not super impressed so far. 

As far as I can tell as well for Windows devices, it will only work IF the user is signed into Chrome, with the endpoint verification extension forced OR the actual device is managed by Google Workspace. 

I also can't seem to export the required asset info for CE at the moment - as I need make and model, and most of the device information seems to be missing the make... 

"Make" is not a recorded field - I've noticed in some cases, the make is included in the model field (e.g. "VivoBookASUSLaptop X509JAP1510CJA"), but the position is not consistent.  That has not been a concern for me, as our asset database is very close to accurate, and the serials match up, so we'd have that as a reference if needed.

 

The Chrome requirement appears to be a major hurdle.  It looks like the policies are only enforced when using Chrome, so a user on an unsupported OS could simply sign in with a different browser - Even if we set Chrome as a requirement for sign in......

 

I'll continue testing, but this looks like another Google feature that had no thought put into it before rollout.

[StephenPink]

7 hours ago, Shaun_Dark_Lord said:

"Make" is not a recorded field - I've noticed in some cases, the make is included in the model field (e.g. "VivoBookASUSLaptop X509JAP1510CJA"), but the position is not consistent.  That has not been a concern for me, as our asset database is very close to accurate, and the serials match up, so we'd have that as a reference if needed.

 

The Chrome requirement appears to be a major hurdle.  It looks like the policies are only enforced when using Chrome, so a user on an unsupported OS could simply sign in with a different browser - Even if we set Chrome as a requirement for sign in......

 

I'll continue testing, but this looks like another Google feature that had no thought put into it before rollout.

Yeah it's very annoying - I've had to manually look up based on the info in the model field. Unfortunately, whilst our asset database is correct, this is the BYOD device information that is required for CE. 

Yup it's a real shame. There are some things Google does so much better than Microsoft - but Intune has come along so much recently that Google can't compete.