Is there any way to restrict access to Gmail accounts from certain IP/MAC addresses ? For instance, can I setup Google Apps so that my users can access their GMail account from within the corporate firewall or from outside the firewall on a known machine, but not from a public browser or public machine. Or what would be best practice to prevent unauthorized access to corporate GMail accounts?
GMail has no IP or region restrictions. What you could do though is enable 2-step verification to add further protection?
This requires two steps in setting up, one at the domain level:
- Go to your Google Apps administrator control panel.
- Click the Advanced tools tab.
- Under Authentication > 2-step verification, check Allow users to turn on 2-factor authentication.
And the other on a per user basis:
Settings -> Accounts and Import -> Change Account Settings -> Other Google account settings -> Using 2-step verification
NOTE: The users have to manually opt-in even if you have this enabled at the domain level.