How Do You Implement GSuite Tenant Restrictions?

[jebeling]

Google has published an article here: Google Support Article on Implementing Tenant Restrictions that states you need a proxy that can:

1. Decrypt SSL
2. Insert headers

McAfee Web Gateway supports both of these features.

From the above article:

"As an administrator, you may want to prevent users from signing in to Google services using any accounts other than the accounts you provided them with. For example, you may not want them to use their personal Gmail accounts or a managed Google account from another domain.

A common means of blocking access to web services is using a web proxy server to filter traffic directed at particular URLs. This approach won’t work in this case, because legitimate traffic from a user’s managed Google account goes to the same URL as the traffic you want to block.

To only allow users to access Google services using specific Google accounts from your domain, you need the web proxy server to add a header to all traffic directed to google.com; the header identifies the domains whose users can access Google services. Since most traffic through your Google service is encrypted, your proxy server also needs to support SSL interception. (See below for a list of proxy servers known to support both SSL interception and HTTP header insertion.)"

McAfee Web Gateway (MWG) is on the list and by extension McAfee Web Gateway Cloud Service (WGCS) also supports the necessary features if operated in a hybrid mode where WGCS policy is managed by MWG.

[jebeling · Accepted solution]

Please see KB article 72538

SSL scanning must be enabled at least for the google login sites.

This is available with all currently supported versions of MWG and is supported in the cloud via WGCS if policy is managed by MWG.

The KB article references Google mail but covers all google services that require login.

From the Google support article:

"Users attempting to access Google services from an unauthorized account will see a web page describing the unavailable service, the unauthorized account they're using, the domains where the service is unavailable, and a suggestion that they contact a network administrator for more information and sign out of their unauthorized account and sign in with an authorized account.

Note: This approach blocks sign-in access to Google consumer services other than Google Search, but does not necessarily prohibit anonymous access.

Google does not maintain a list of blocked services. If a particular service requires login, access will be blocked. Services which do not require authentication, such as Google Search and YouTube will not be blocked."

[Tom-Watson]

That KB article seems to have been removed. We only referred to it last month and implemented its recommendations successfully. I was showing a colleague as part of some knowledge transfer though 😞

Do you know if it will be re-instated? Seems crazy to be missing.