Controlling AppSheet access by time and network using Google Workspace

Google Workspace Developers Q&A
1

I have a company that uses AppSheet applications with users authenticated through corporate Google Workspace accounts.

I would like to know whether these controls can be implemented through Google Workspace, even if they cannot be implemented directly within AppSheet:

  1. Automatically sign out or revoke users’ sessions at a specific time, for example, 6:00 PM.

  2. Prevent users from signing in again after that time.

  3. Allow access to AppSheet only when the user is connected to the company’s/store’s network.

  4. Restrict access based on the company’s public IP address.

  5. If a user already has AppSheet open, prevent them from continuing to use the application after the cutoff time or when they are outside the authorized network.

The users authenticate to AppSheet using their Google Workspace accounts.

My question is: which Google Workspace features can be used to implement these controls, and which Google Workspace editions/licenses are required?

The goal is to use Google Workspace as the authentication and security layer for controlling access to AppSheet.

I would also like to know whether Context-Aware Access can be applied to this scenario, and whether it can specifically control users’ access to AppSheet applications based on time and IP address.

2

Context-Aware Access sounds like the right place to look for the network/IP part of this. You can define trusted networks and use the user’s context when deciding whether access should be allowed, so that’s a better fit for the “only from our company/store network” requirement.

I’d be more careful with the 6 PM requirement, though. There’s a difference between preventing a user from starting a new session and forcing an AppSheet app that is already open to immediately stop working. I wouldn’t assume that a Workspace access policy will terminate an existing AppSheet session at exactly 6 PM.

If the 6 PM cutoff is a hard business requirement, I’d put that check in the AppSheet app as well. For example, have the app determine whether the current time is within the allowed operating hours and prevent the relevant actions outside that window. Then Workspace/Context-Aware Access can deal with the identity and network restrictions.

For the IP restriction, also test the actual behavior when someone leaves the company network while the app is already open. That will tell you whether the policy is being enforced continuously or only when access is evaluated again.

The Workspace edition is the part I’d verify before buying anything, because the availability of Context-Aware Access and the applications/policies it can be applied to depend on the Workspace edition. I’d check the exact edition against the AppSheet access scenario rather than upgrading based only on the name of the feature.

So I’d treat this as Workspace/Context-Aware Access for identity + network, and AppSheet logic for the strict time cutoff. That should give you much more predictable control than relying on Workspace alone.