How to block access to Google services from personal devices?

[ser-storchak]

The user has a personal iphone device (unmanaged device). He should not have access to any Google services from this device (even via a web browser). The user refuses to set the Device Policy, so the "Advanced" setting does not work for him (Devices > Mobile and endpoints > Universal Settings > General > Mobile management > Advanced (Requires the Device Policy app).

The notification about the installation of the Device Policy app appears only when installing Google apps (for example, Gmail app). If the user add a google account manually (Settings > Passwords & Accounts > Add Account > Google), he has access to Email, Contacts, Calendars, Notes.

Any rules for the device also do not apply to it (perhaps I do not know how to work with them).

Please help me!

[thomas_prescott]

IMAP has to be disabled for the General iOS stuff to stop syncing. That will break other things, obviously. This will not block mobile browser access, however.

[arto_schneider]

Have you checked if Context Aware Access could prevent access from personal devices?

[cryptochrome]

Hi,

you can set up device approval so that whenever a user tries to log in from a new device, an admin has to approve it first. You need at least Business Plus for this and you can read more about it here:

https://support.google.com/a/answer/7508418

[christiannewman]

Enable device approvals so that only approved user-owned devices, in addition to company-owned devices, can access your organization's Google Workspace accounts. Learn more about Device approvals

I also recommend restricting access to Google Workspace services in API controls so that only pre-approved third-party apps, in addition to first-party Google applications, can access Google Workspace services. Learn more about API controls and app access

Here to help if you have any questions.

[sesz]

Device approval doesn't work when you logi in using browser on your private phone