Allow users to unblock apps with remediation messages in Context Aware Access

Using remediation messages and custom messages in Context-Aware Access, you can help users unblock themselves when a policy prevents them from accessing an app. These optional (but recommended) messages can help get users back to productivity and reduce support calls for admins.

For example, say that a user on a mobile device is using Gmail in the office successfully during the day, but is blocked when they try to access Gmail at home in the evening. When remediation messages are enabled, they will see guidance on how to address the reason they are blocked.

Remediation and custom messages are supported for access levels created in both Basic mode and Advanced mode. Also, they are supported for both Core Services and SAML apps.

Use remediation messages and custom messages to help your users unblock themselves

When blocked, your users can encounter:

• Default message—Displays if you have not added remediation messages or custom messages. An example default message is: Your organization's policy is blocking access to this app.
• Remediation messages—Replaces the default message. The messages are system generated, and correspond to the specific policy violation that blocked the user.
  Remediation messages can present several remediation options to the user, which they can expand by clicking Show more options. In the case of several remediation options, the user needs to complete the steps for any one of the available options to unblock themselves.
• Custom message—Adds specific help for the user, such as additional advice on getting unblocked or a helpful link to click. You add custom messages as needed. A custom message can appear in conjunction with the default message, or with remediation messages. 

This table shows the interactivity of these messages:

Understand remediation messages

Each remediation action corresponds to an attribute which is causing access to be denied. The following table summarizes possible remediation messages that the user might see. The messages are created systematically depending on the policy that was violated.

Note that different messages can be shown for the same attribute according to the expectation in the access level. For example, if the access level is device.screen_lock_enabled == true, the message is Set a screen password on your device. If access level is device.screen_lock_enabled == false, the message is Remove the screen password from your device. Removing a screen password could be less secure, so the user should confirm this action with the admin.

Actual messages might differ from the messages displayed below.

¹ Make sure the partner security app (for example, Lookout) is installed on the device. If it’s installed but the user is still seeing this message, the device might not be properly enrolled into the partner MDM. Check the partner dashboard to verify if this is the case. If required, contact the partner to resolve the issue.

² Check the partner app on the device for more details. If required, contact the partner to resolve the issue.

Understand remediation messages and third-party partner integrations

As an administrator, you can integrate supported third-party partners (those that are part of the BeyondCorp Alliance) with Google endpoint management in Google Admin console. This informational text displays in the remediation message interface to explain that partner messages can be available to users:

For example, from Lookout:

For details, go to Set up third-party partner integrations.

Common errors to resolve before remediation or custom messages can be seen by the user

These errors must be cleared before users can view remediation messages:

Your device can’t be recognized. There may be different steps depending on your device type.

Google doesn’t recognize the login device. The remediation step depends on the platform.

• Desktop devices—Users must use a Chrome profile with the Endpoint Verification extension installed. Users can’t login to Google Workspace apps through incognito, guest, or personal profiles. Note that this error message can display when a user tries to sign in to a new device for the first time. In that case, the user must sync with the Endpoint Verification extension and refresh the browser.
• Mobile devices—For devices to be recognized by CAA, they need to be managed by Google endpoint management (basic or advanced management). For details, go to Manage devices with Google endpoint management.  Additionally, devices might need to sync before Google can recognize where the login occurred. For details, see Sync your device.

Sync your device

• Desktop devices—Users must sync with the Endpoint Verification extension.
• Desktop devices—Devices under advanced management can sync with the device policy app. Devices under basic management can wait for the device to sync automatically,  or the user can re-login into any Google app. Let the user know that device sync can take some time.

  • iOS devices—Google sessions across different applications are tracked with sessions or tokens in Safari. If the Safari tokens are deleted (manually by the user or Apple ITP), the subsequent logins cannot be mapped to the original logged in device. This can cause the new logins to be blocked with “Your device can’t be recognized. There may be different steps depending on your device type” message if remediation is enabled. This issue can occur both on basic and advanced managed devices.
    
    The user needs to complete the following steps to unblock themselves: 

    1. Remove the Google enterprise account from all Google applications.
       Log out the Google account from Safari and remove it from any non-Google application which might be using it. 

    2. Delete Safari cookies and cache.

    3. Log into any Google first-party application, such as Drive or Gmail. 

    4. Access all of the remaining Google first-party applications to verify that you have access. 

    5. If access to non-Google applications is needed, sign in to the applications within a few days of logging into the Google applications.
       If you do not sign in within 30 days of step 3 and the application is blocked, restart from step 1.

Implement remediation or custom messages

Turn on remediation messages

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to Security Access and data controlContext-Aware Access.
3. Select User message.
4. Under Remediation messages, click OFF and slide right to turn the messages ON. You’ll see a check mark.
5. Click Save.
   You can also add a custom message at this point.

Add a custom message

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to SecurityAccess and data control Context-Aware Access.
3. Select User message.
4. Under Additional custom message, enter your message.
5. Click Preview to see what the user will see.
6. Click Save.

User experience for remediation and custom messages

Default message only

This is an example of a message the user sees if no remediation messages or custom message is configured.

Default message and custom message

This is an example of a message the user sees if no remediation messages are configured, but the custom message is provided.

Remediation message only

This is an example of a message the user sees if remediation messages are configured with no custom message. The user clicks Show more options to expand the remediation steps.

Remediation and custom message

This is an example of a message the user sees if both remediation messages and the custom message are configured. The user clicks Show more options to expand the remediation steps.

Context-Aware Access remediation and custom messages FAQ

Expand all  |  Collapse all