Omnissa Secure Access Suite

Objective 

In this lab, you will gain hands-on experience configuring and testing the Omnissa Secure Access Suite. Working through a series of guided exercises, you will set up enterprise security policies, enforce data loss prevention controls, integrate identity and access management, and validate the end-to-end behavior of these controls across both managed and unmanaged devices.

  1. Assigning Chrome Enterprise Premium License

  2. Configure Chrome Enterprise Premium with foundational security and reporting policies

  3. Deploy and enforce Endpoint Verification across devices
  4. Create Context-Aware Access (CAA) control rules to protect corporate applications

  5. Define Application Boundaries to prevent data leakage between trusted and untrusted destinations

  6. Build Data Loss Prevention (DLP) rules to safeguard sensitive information

  7. Integrate Omnissa Access with the Chrome Admin Console for SSO and compliance

  8. Validate security policies on Un-managed device 

  9. Enroll Windows VM to Workspace ONE UEM

  10. Publish and manage Chrome applications via Workspace ONE UEM on corporate-owned devices

  11. Validate security policies on Managed device

  12. Test URL filtering policies for Generative AI and other restricted sites

 

 

Expand or collapse content Task 1: Assigning Chrome Enterprise Premium License

The first step to configure Chrome Enterprise Premium would be to enable/check if the targeted user account has the Chrome Enterprise Premium License assigned. To validate the assignment follow the steps below.

Expand or collapse content 1. Log into Google Admin console
  1. Login to Chrome admin console by browsing admin.google.com on your assigned Windows virtual machine using Google Chrome Browser.
  2. Login to admin.google.com site using the credentials provided to you , it should be of the format sudent6!@#[email protected]
  3. Once logged in , navigate to Users and select your user account like Student6!@#[email protected]
  4. Click on Assign Licenses
  5. Select Chrome Enterprise Premium(offline pricing)
  6. Click Assign

 

Note: For any Login issues are License assignment issues reach out to the Lab Instructor

Expand or collapse content 2. Task 2 : Configuring Chrome Enterprise Premium with foundational security and reporting policies

The next task is to configure the core foundation security setting and enabling reports for administrators to track browser. 

  1. In the Main Menu Click Device > Chrome > Settings, then select the User & Browser settingstab.

  2. In the Settings explorer on the left, select your organizational unit

Tip: Use the search bar at the top of the settings page to find each policy by name quickly.

    3.  For each setting below, click into the section, configure as described, and then click Save.

Tip: Click Close once you've configured a setting to return to the User & browser settings so you can configure the next. You may also need to close out any existing filters to view all the settings once more.

  • Device Token Management: Set Configuration to Delete Token. It automatically cleans up your managed browser list, preventing stale records.

  • Event reporting: Select Enable event reporting. This is the foundation for threat detection, sending security events to the Admin console for analysis.

  • Managed browser reporting: Set to Enable managed browser cloud reporting. Provides a complete inventory of all enrolled browsers in your organization.

  • Managed profile reporting: Set to Enable managed profile reporting for managed users. It extends visibility to managed profiles on unmanaged (BYOD) devices.

  • Managed browser reporting upload frequency: Enter 3 as the upload frequency in hours. The default is 24 hours; a shorter interval provides more up-to-date data for quicker security responses.

  • Real time URL check: Set to Chrome Enterprise Premium. It enables advanced, real-time phishing and malware protection via Google's Safe Browsing service.

  • Upload content analysis: Select Chrome Enterprise Premium. Click Additional settings. Check the boxes for Delay upload until analysis is complete and Block file upload on failure. Inside Check for sensitive data, set Mode to On by default, except for the following URL patterns. Under Check for malware, set Mode to On by default, except for the following URL patterns. It activates DLP scanning for file uploads and ensures files are cleared before the upload completes.

  • Download content analysis: Select Chrome Enterprise Premium. Click Additional settings. Check the boxes for Delay file access until analysis is complete and Block file access on failure. Inside Check for sensitive data, set Mode to On by default, except for the following URL patterns. It activates DLP and malware scanning for downloads, preventing users from opening a file until it's approved.

  • Bulk text content analysis: Select Chrome Enterprise Premium. Click Additional settings. Check the boxes for Delay text entry until analysis is complete and Block text entry on failure. Inside Check for sensitive data, set Mode to On by default, except for the following URL patterns. Set the minimum number of bytes to 1. It activates DLP scanning for pasted content, preventing sensitive data leakage.

2.1. Enable Advance Data Protection Features

  1. In the Main Menu , click Security > Access and Data Control  and scroll down to Data Protection.
  2. Scroll down to Data protection settings.
  3. For each setting below, turn the switch to On, and then click Save.

    • Data insights scanning and report > For Google Chrome: It activates additional reporting for content that is downloaded, uploaded, or printed.

    • Optical character recognition (OCR) > For Google Chrome: It enhances DLP by allowing scans to read text inside images and PDFs.

    • Sensitive content storage: It stores the actual content that triggers a DLP rule, which is invaluable for security investigations.

Expand or collapse content Task 3: Deploy and enforce Endpoint Verification across devices

Endpoint Verification is a key element of a zero-trust security framework, gathering critical device information required to define and enforce device-based access policies.

Expand or collapse content 1. Force Install Endpoint verification extension
  1. In the Main Menu, click Devices > Chrome > Apps & extensions and select the Users & browsers tab
  2. In the Apps & Extensions explorer on the left hand side, select your organizational unit.
  3. Click the Yellow + menu, bottom right of screen and select Add from Chrome Web Store and select Add from Chrome Web Store.
  4. Search for Endpoint Verification and press ENTER. Or search with the App ID: callobklhcbilhphinckomhgkigmfocg.
  5. Click Select on the top right to install the official extension by Google.
  6. In the installation policy menu, select Force install + pin to the browser toolbar.

  7. Click Save in the top right

     

Task 4 : Create Context-Aware Access (CAA) control rules to protect corporate applications

In this task, you create two access levels. The first identifies unmanaged devices for a context-aware DLP rule. The second is a more advanced rule to protect Google Calendar by requiring both a managed browser and a minimum Chrome version.

Create an advanced access level for unmanaged devices

  1. In the Main Menu , click Security > Access and data control > Context-Aware Access.
  2. Click TURN ON to enable Context-Aware Access.
  3. Click Create access level.
  4. Set the Access level name to Unmanaged Device.

  5. In the Context conditions section, click the Advanced tab to use Common Expression Language (CEL).

  6. Enter the following expression:

device.chrome.management_state != ChromeManagementState.CHROME_MANAGEMENT_STATE_BROWSER_MANAGED
Click to copy

    7.  Click Create and then click I'M DONE. (You do not assign this to an app; it is used later in a DLP 

         rule)

Expand or collapse content Create Advanced Access Level for Managed Browsers
  1. Again, on the Context-Aware Access screen, click Create access level
  2. Set the Access level name to Device enrolled managed browser.
  3. In the Context conditions section, click the Advanced tab to use Common Expression Language (CEL).

  4. Enter the following expression:

device.chrome.management_state == ChromeManagementState.CHROME_MANAGEMENT_STATE_BROWSER_MANAGED && device.chrome.versionAtLeast("139.0.0000.00")

   This expression checks for two conditions: (1) that the browser is enrolled and managed by your organization, AND (2) that the browser version is at least 139.

   5.  Click Create and then I'M DONE

Expand or collapse content 1. Assign the advanced access level to Google Calendar
  1. Again, on the Context-Aware Access screen, click Assign access levels to apps hyperlink in the Assign access levels section.
  2. Select the Contractors organizational unit on the left.
  3. Click the Actions dropdown next to Calendar and select Assign.
  4. Find the Device enrolled managed browser access level, check Active, and click Save.
  5. For Action, select Block and click Save, and then click Assign.

Task 5 : Define Application Boundaries to prevent data leakage between trusted and untrusted destinations

This task once completed will prevent data from being copied from trusted corporate websites and pasted into untrusted destinations, such as other Chrome profiles, incognito sessions, or applications outside the browser. It serves as a critical safeguard against data exfiltration.

  1. In the Main Menu, click Devices > Chrome > Settings. Be sure you're in the Users & browser settings tab.

  2. In the left pane, ensure you are at the right organizational unit.

  3. Search for the Restricted sources for pasting setting and then click Restricted sources for pasting from the results.

  4. Set the Restriction type to Allow copying from the following content sources, except when pasting to certain destinations.

  5. In the Content sources field, enter https://support.google.com/chrome.

  6. In the Block pasting to section, select the checkboxes for:

    • Block pasting to Other Chrome profiles

    • Block pasting to Incognito mode

    • Block pasting to Applications other than Chrome

  7. Click Save.

Task 6: Configure DLP and URL filtering rules

This task strengthens data protection by identifying sensitive information, such as credit card numbers, and regulating access to specific web categories to reduce the risk of data loss and support acceptable use policies

Create a "Block on Credit Card Number" rule for unmanaged devices

  1. In the Main Menu , click Security > Access and data control > Data protection.
  2. Go to the Data protection rules and detectors card and then click Manage Rules, then Add rule > New Rule.
  3. Set Name to Block CCN on Unmanaged Devices.
  4. Scroll down to Apps section and select Chrome.
  5. Select the File uploaded, File downloaded, and Content pasted options for Chrome.
  6. Click Continue.
  7. In the Actions section, for Chrome actions, select Block.
  8. Set Alerting to High.
  9. Click Continue.
  10. In the Scope section, select All in Google Workspace Labs.
  11. Click Include organizational units and select the Contractors organizational unit.
  12. Click Done.
  13. Click Add Condition to define the triggers for the rule.
  14. Field: Leave All content.
  15. What to scan for: select Matches predefined data type (recommended) from the menu options.
  16. Set Data type to Global: Credit card number.
  17. Set Likelihood Threshold to Medium.
  18. Under Context conditions, click Select an access level and choose the Unmanaged Device level you created. This ensures the DLP rule only applies to unmanaged machines.
  19. Click Continue.
  20. Click Create.

Create a custom detector for an allowlist

This control supports DLP policy enforcement by defining approved Generative AI tools as an allowlist, which serves as an exception mechanism in the following rule while maintaining protection against unauthorized data sharing

  1. In the Main Menu , click Security > Access and data control > Data protection.
  2. In the Data protection rules and detectors section, click Manage detectors.
  3. Click Add detector > Word list.
  4. Set Name to Approved Gen AI tools.
  5. Under Enter words separated by commas, enter gemini.google.com.
  6. Click Create.

Create a URL filtering rule to block unapproved generative AI sites

  1. Navigate to Manage Rules, then select Add Rule > New Rule.
  2. Enter Block Unapproved Gen AI Sites as the rule name.
  3. In the Apps section, choose Chrome.
  4. For Chrome, select URL Visited as the activity to monitor, then click Continue.
  5. Under Actions, set the Chrome action to Block.
  6. Configure the Alerting level as High, and then select Continue.
  7. In the Scope section, choose Include organizational units and select the Managed Devices organizational unit. Click Done.
  8. In Content Conditions, create the following criteria:
    • Add a condition and configure it as URL Category > Matches > Internet & Technology > Generative AI.
    • Click Select to save the condition.
  9. Add another condition to create an AND relationship.
  10. In the newly added condition block, enable the NOT operator (represented by the no-entry icon).
  11. Within the NOT block, configure the condition as:
    1. URL → Matches words from a word list
    2. Select the Approved Gen AI Tools detector.
    3. Set Match Mode to Match any word.
  12. Click Continue and then select Create to save and activate the rule.

Why blocking shadow gen AI is important: Blocking unapproved shadow gen AI tools is a critical security measure. Employees might unknowingly paste sensitive corporate data—such as source code, financial projections, or customer PII—into a public AI tool. By creating a rule that blocks the general category but allows a specific, vetted tool, you enable productivity safely while protecting the organization from the risks of uncontrolled AI usage.

Task 7: Integrate Omnissa Access with the Chrome Admin Console for SSO and compliance

In this task, you will integrate the Chrome Admin Console with Omnissa Access to validate conditional access policies. The objective is to compare the user experience when accessing a web application from a managed Chrome browser or Chrome profile versus an unmanaged Chrome browser or profile, ensuring that access is granted or restricted based on the device and browser management status.

  1. log in to your Omnissa Access Tenant.
  2. Navigate to Integrations then select Google Chrome Enterprise Device Signals.

  3. Click Configure.

  4. Enable Google Chrome Enterprise Device Signal Adapter by clicking on the toggle to Yes.

  5. Copy the URLs matcher and IDP Service Account email to notepad as this will be used while    

      configuring Google Admin console. 

  6. Enable Verify devices disk encryption status by clicking on the toggle to Yes.

  7. Enable Verify devices firewall status by clicking on the toggle to Yes.

  8. Enable Verify device screen lock status by clicking on the toggle to Yes.

  9. Save the Settings by clicking on Save.

Configure Authentication methods

Enable Google Chrome Enterprise Device Signals as the authentication method on your build in IDP. 

  1. Navigate to Integrations > Identity providers > Select IDP.

  2. Enable Google Chrome Enterprise Device Signals.

  3. Save the settings.

Configure Application Policy

Create an authentication policy application to validate if the user is accessing the application from a managed compliant browser. 

Configure authentication policy using the steps below. 

  1. Navigate to Resources > Policies > Add Policy.

  2. Enter Policy Name and provide a Description (optional).

  3. Click on Add Policy Rule.

4.Select All device Types for “and the user accessing content from”.

5.Select Password (Cloud deployment) as “then the user may authenticate using”.

6.Select Add Authentication to select Google Chrome Enterprise Device Signals as secondary authentication.

7.Under Advanced Properties, add a custom message like “Access denied. You must access this app using a managed Chrome browser.”

8.Save the configuration.

Configure Web application

To configure a web application, follow the steps below. 

1.Navigate to Resources > Web Apps.

2.Click on New.

3.Browse for application available in catalog, else enter Name and Description manually.

4.Fill in the mandatory fields like Sigle Sign-On URL, Recipient URL, Application ID, Username Format and application parameters. 

E.g. Bamboo HR application configuration. 

 

5.Select the Access Policy created in the previous step.

6.Save & Assign the application to the users.

Configure the Connector in Google Admin Console

The final step to integrate Omnissa Access with Chrome Enterprise is to configure the Connector.

1.Log into https://admin.google.com.

2.Navigate to Chrome browser > Connectors > NEW PROVIDER CONFIGURATION >Setup Omnissa.

3.Enter Configuration name like, Omnissa.

4.Enter the URL patterns to allow one per line by copying the details from Omnissa Access console.

5.Enter the Service account, one per line by copying the details from Omnissa Access console.

6.Save Configuration.

Task 8: Validate security policies on Un-managed device

In this scenario, the Windows VM acts as an unmanaged, personal device. You connect to it to test the policies you configured in previous sections (Access Levels and DLP).

Connect to Windows VM

  1. To open the browser-based Windows desktop, click Open Windows VM in the Lab details pane in the lab instructions. This logs you in to the Windows VM.
  2. Launch Google Chrome Browser but do not sign in.
  3. Copy and paste the following URL into the Chrome browser in the VM

https://dlptest.com/sample-data/

    4. Download the sample PDF link from the sample Name + CCN + ZIP.

    5. Expected result: The file should download. This shows a default profile has no controls.

Note: If the file download is blocked, ensure you are not signed in with any account.

Sign in to create a managed profile

  1. In Chrome, click the profile avatar > Sign in to Chrome
  2. Sign in with the user credentials that you copied down earlier. Agree to the terms and turn on sync

Test the device-based access level (initial block)

  1. Click the Endpoint Verification extension icon in the toolbar and click Sync now
  2. Navigate to Google Calendar
  3. Expected Result : You should be blocked because the browser is not enrolled as a managed device.

Test the application boundary rule

  1. Test Download: Browse https://dlptest.com/sample-data/ and click the PDF link.

  • Expected result: The download should be blocked.

   2.  Test Paste: Browser https://dlptest.com/https-post/ Copy a sample Credit Card Number from the 

         PDF you downloaded in the baseline test and try to paste it into the "Test Message" field.

  • Expected result: The paste action should be blocked.

  3.  Test Upload: On the same page, try to upload the sensitive PDF file.

  • Expected result: The file upload should be blocked.

Task 9 : Enroll Windows VM to Workspace ONE UEM

0 Comments

Add your comment

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.