Automated account suspension for specific IP logins

To enhance security, you can set up an activity rule that monitors login events. This rule can immediately suspend a user's account if they sign in from an IP address range that you have marked as restricted.

Caution: Make sure that your IP address ranges are precise. If the IP range is incorrect, legitimate users who sign in from authorized company networks or VPNs could be mistakenly suspended.

Before you begin

Your ability to create and review activity rules depends on your Google Workspace edition, administrative privileges, and data source. For details, go to Admin access to reporting rules & activity rules.

Create an activity rule to suspend specific IP login events

  1. In the Google Admin console, go to Menu and then Rules.

    Requires having the Reports administrator privilege.

  2. Click Create rule and then Activity.
  3. On the Rule details and scope page, enter a rule name and (optionally) a description.
  4. Click Continue.
  5. On the Conditions page, click Data sourceand thenUser Log events.
  6. Select Successful login as the primary event.
  7. Click Add condition.
  8. For Attribute, select IP Address.
  9. In the IP address field, enter the IP address that you want to monitor.
  10. Click Continue.
  11. In the Action and notification section, click Add action.
  12. Click Select action > Suspend users.
  13. (Optional) To notify super admins by email when the rule is triggered, for Notification, check the Email box.
  14. On the Review page, review all of your details, then click Create Rule.
Changes can take up to 24 hours but typically happen more quickly. Learn more