Personal Google Account Blocking

Overview

Personal Google Account Blocking prevents students from signing into personal (non-school) Google accounts on managed devices. Students can only authenticate with Google accounts that belong to your school's approved domains — keeping them in your managed Google Workspace where policies, monitoring, and safety features apply.

Without this feature, a student could sign into a personal Gmail account and bypass your school's Google Workspace controls, access unmonitored Drive files, or use personal YouTube history.

Prerequisites

• KyberGate organization with proxy filtering active (Proxy v32+)
• Your school's Google Workspace domain(s) identified
• Admin access to the KyberGate dashboard

How It Works

KyberGate's proxy inspects Google authentication traffic and checks the account domain against your approved list. If a student tries to sign in with a personal Gmail account (or any non-approved domain), the sign-in is blocked and the student sees a friendly block page explaining they must use their school account.

This enforcement happens at the proxy level, so it works across all browsers and cannot be bypassed by switching browsers or using incognito mode.

Steps

Step 1: Navigate to Google Account Settings

Log in to the KyberGate dashboard. Go to Settings → Filtering → Google Accounts.

Step 2: Enable Personal Account Blocking

Toggle Block Personal Google Accounts to ON.

Step 3: Configure Allowed Domains

In the Allowed Google Domains field, enter your school's Google Workspace domain(s). For example:

• myschool.org
• students.myschool.org
• staff.myschool.org

You can add multiple domains. Only accounts ending in these domains will be allowed to sign in.

This sets the allowedGoogleDomains field in your organization's Firestore policy document.

Step 4: Choose Enforcement Schedule

Select when personal account blocking is enforced:

• Always — personal accounts are blocked 24/7, on-campus and off-campus
• School Hours Only — personal accounts are blocked during your configured school hours; allowed outside school hours
• On-Campus Only — blocked when connected to school network; allowed at home
• Custom Schedule — define specific days and times

Most schools choose Always for maximum protection.

Step 5: Test the Block

On a student device:

1. Open Chrome and go to accounts.google.com
2. Try signing in with a personal Gmail address (e.g., student.personal@gmail.com)
3. Verify the KyberGate block page appears with the message: "Personal Google accounts are not allowed on this device. Please sign in with your school account (@myschool.org)."
4. Sign in with a school account and verify it works normally.

Step 6: Review Block Logs

Go to Reports → Activity Logs and filter by category "Google Account Block" to see all blocked personal sign-in attempts. Each entry shows the student, device, blocked email domain, and timestamp.

What Students See When Blocked

When a student tries to sign into a personal Google account, they see a KyberGate block page that displays:

• A clear message: "Personal Google accounts are not permitted on school devices."
• The list of allowed domains: "Please sign in with your @myschool.org account."
• A "Sign In with School Account" button that redirects to Google sign-in with the allowed domain pre-selected.
• The school name and logo (if configured in dashboard settings)

The block page is friendly, not punitive. It guides students to the correct action.

Tips

• Include ALL your school's Google Workspace domains, including any sub-domains used for students vs. staff
• If your district has multiple schools with different domains, add all of them
• Personal account blocking also prevents students from adding secondary Google accounts in Chrome
• Staff/admin accounts can be excluded via the Exceptions list if staff need personal Google accounts for professional development
• Combine with YouTube Distraction Hiding for comprehensive YouTube management

FAQ

Q: Does this block all Google services or just sign-in? A: It blocks sign-in to non-approved Google accounts. Google services like Search, Maps, and Translate still work without sign-in. Students just cannot authenticate with personal accounts.

Q: What about Google Classroom invitations from other domains? A: Students can still access Google Classroom content shared with their school account. The block only prevents signing into a different Google account.

Q: Does this affect Chromebook device accounts? A: On managed Chromebooks, device enrollment already restricts sign-in to approved domains via Google Admin. KyberGate's personal account blocking adds a second layer of enforcement at the network level, which also covers non-Chromebook devices (iPads, Windows, Macs).

Q: Can students still use personal Google accounts on their personal devices? A: This only applies to managed devices connected through KyberGate. Personal devices are not affected unless enrolled.

Q: What if we allow personal accounts during summer? A: Use the School Hours Only or Custom Schedule enforcement option to allow personal accounts outside the school year. You can also temporarily toggle the feature off.