QAuth · Controls reference
Every access, identity and sign-in control in one place.
Each control applies to the whole organisation, an organisational unit (OU) or a single user, from the same console. Here’s what each one does, when to use it, and how often customers in the case studies did.
Access control
Most customers start here. IP restriction alone was part of 13 of the 20 published deployments.
Google Workspace · Microsoft 365
Allow sign-in only from IP addresses you define, as a whitelist or a blacklist. No firewall changes or local installation.
Use it whenCompany data should only be reachable from the office or a known VPN.
Google Workspace · Microsoft 365
Bind each user to approved devices, identified by MAC address, so unknown, public or personal machines are blocked. One user can have several approved devices.
Use it whenLaptops get lost, or people use shared or home computers.
Google Workspace · Microsoft 365
Whitelist the browsers people may use, such as Chrome, Firefox, Safari or Edge, for an OU or a set of users. Any other browser is blocked.
Use it whenOnly managed browsers should touch company data.
Google Workspace · Microsoft 365
Limit access to the days and hours you set, across time zones.
Use it whenThere’s no reason to reach company data after hours, or shift patterns need enforcing.
Google Workspace · Microsoft 365
Allow access only from the cities or countries you choose, and get an alert when someone tries from outside.
Use it whenYour people work from a known set of places.
Google Workspace
Sign people out after a set idle time, and cap how long any session can last.
Use it whenScreens are left unattended and still signed in.
Google Workspace
Stop people signing in to personal Gmail, or another domain’s Google account, on the company network and company devices. Company Gmail keeps working.
Use it whenCompany data mustn’t move into personal mailboxes.
Google Workspace
People can sign in to third-party apps with their work account only if you’ve whitelisted the app, so you don’t have to revoke access after data has been shared. Delivered by a browser extension pushed from Chrome management.
Use it whenFree apps ask for access to calendars and Drive.
Google Workspace
Allow sign-in only to your own Google domain and its subdomains, so accounts from a previous employer or any other domain can’t be used.
Use it whenClient confidentiality matters and people hold several Google accounts.
Identity
Single sign-on, stronger passwords and a second factor, with your existing directory as the source of truth.
Google Workspace · Microsoft 365
One set of credentials and one portal for every sanctioned app, using SAML, with provisioning and de-provisioning so leavers lose access straight away.
Use it whenPeople juggle many passwords, or leavers keep access too long.
Google Workspace · Microsoft 365
A code from the user’s phone as well as the password, so a stolen password alone isn’t enough to get in.
Use it whenA password is the only thing between the internet and company data.
Google Workspace · Microsoft 365
Complexity rules, and expiry on a cycle you choose, such as a week, 15 days or a month, with email reminders before passwords expire.
Use it whenWeak or never-changed passwords are a risk.
Google Workspace · Microsoft 365
People reset a forgotten password themselves by answering security questions you set, instead of waiting for an admin.
Use it whenPassword resets fill the helpdesk queue. Three case-study customers cut tickets by 20–30%.
Google Workspace · Microsoft 365
Use on-premises Active Directory or Azure AD (now Microsoft Entra ID) as the identity provider, including multiple forests, with password changes synced to the cloud suite.
Use it whenIdentities already live in AD and people should keep one password.
Sign-in and reporting
Every employee signs in at least once a day. These controls brand that moment, use it to communicate, and report on what happened.
Google Workspace
Replace the generic sign-in page with your own HTML or a template, carrying your name, logo and web address.
Use it whenPeople confuse company and personal sign-in, or you want one brand across campuses or companies.
Google Workspace
Send people to your intranet, or to a Google Drive or Slides page, straight after they sign in.
Use it whenIntranet news goes unread.
Google Workspace
Show a message at sign-in to everyone or to chosen OUs, as often as you decide.
Use it whenAn announcement has to reach every employee.
Google Workspace
New joiners accept your terms and conditions the first time they sign in to company email.
Use it whenYou need a record that policies were accepted from day one.
Google Workspace
OUs, users, policies and violations at a glance. QAuth syncs with Google Workspace every day, or whenever you press sync.
Use it whenYou need to show who is covered by which policy.
Get started
The QAuth team will help you pick the first policies for your organisation and roll the rest out by OU.
