public sealed class Condition : IMessage<Condition>, IEquatable<Condition>, IDeepCloneable<Condition>, IBufferMessage, IMessage
Reference documentation and code samples for the Identity Access Context Manager v1 API class Condition.
A condition necessary for an AccessLevel to be granted. The Condition is an
AND over its fields. So a Condition is true if: 1) the request IP is from one
of the listed subnetworks AND 2) the originating device complies with the
listed device policy AND 3) all listed access levels are granted AND 4) the
request was sent at a time allowed by the DateTimeRestriction.
public RepeatedField<string> IpSubnetworks { get; }
CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for
a CIDR IP address block, the specified IP address portion must be properly
truncated (i.e. all the host bits must be zero) or the input is considered
malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is
not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas
"2001:db8::1/32" is not. The originating IP of a request must be in one of
the listed subnets in order for this Condition to be true. If empty, all IP
addresses are allowed.
The request must be made by one of the provided user or service
accounts. Groups are not supported.
Syntax:
user:{emailid}serviceAccount:{emailid}
If not specified, a request may come from any user.
Whether to negate the Condition. If true, the Condition becomes a NAND over
its non-empty fields, each field must be false for the Condition overall to
be satisfied. Defaults to false.
public RepeatedField<string> RequiredAccessLevels { get; }
A list of other access levels defined in the same Policy, referenced by
resource name. Referencing an AccessLevel which does not exist is an
error. All access levels listed must be granted for the Condition
to be true. Example:
"accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-28 UTC."],[[["\u003cp\u003eThis document provides reference information for the \u003ccode\u003eCondition\u003c/code\u003e class within the Google Identity Access Context Manager v1 API.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eCondition\u003c/code\u003e class defines criteria for granting an \u003ccode\u003eAccessLevel\u003c/code\u003e, requiring that conditions related to IP subnetworks, device policy, access levels, and timing are met.\u003c/p\u003e\n"],["\u003cp\u003eThe latest version of the API for the \u003ccode\u003eCondition\u003c/code\u003e class is 2.5.0, with previous versions down to 1.2.0 also accessible.\u003c/p\u003e\n"],["\u003cp\u003eKey properties of the \u003ccode\u003eCondition\u003c/code\u003e class include \u003ccode\u003eDevicePolicy\u003c/code\u003e, \u003ccode\u003eIpSubnetworks\u003c/code\u003e, \u003ccode\u003eMembers\u003c/code\u003e, \u003ccode\u003eNegate\u003c/code\u003e, \u003ccode\u003eRegions\u003c/code\u003e, and \u003ccode\u003eRequiredAccessLevels\u003c/code\u003e, all of which contribute to the criteria evaluated for granting access.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eCondition\u003c/code\u003e class implements several interfaces, including \u003ccode\u003eIMessage\u003c/code\u003e, \u003ccode\u003eIEquatable\u003c/code\u003e, and \u003ccode\u003eIDeepCloneable\u003c/code\u003e, and inherits from \u003ccode\u003eobject\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Identity Access Context Manager v1 API - Class Condition (2.5.0)\n\nVersion latestkeyboard_arrow_down\n\n- [2.5.0 (latest)](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1.Condition)\n- [2.4.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/2.4.0/Google.Identity.AccessContextManager.V1.Condition)\n- [2.3.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/2.3.0/Google.Identity.AccessContextManager.V1.Condition)\n- [2.2.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/2.2.0/Google.Identity.AccessContextManager.V1.Condition)\n- [2.1.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/2.1.0/Google.Identity.AccessContextManager.V1.Condition)\n- [2.0.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/2.0.0/Google.Identity.AccessContextManager.V1.Condition)\n- [1.5.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/1.5.0/Google.Identity.AccessContextManager.V1.Condition)\n- [1.4.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/1.4.0/Google.Identity.AccessContextManager.V1.Condition)\n- [1.3.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/1.3.0/Google.Identity.AccessContextManager.V1.Condition)\n- [1.2.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/1.2.0/Google.Identity.AccessContextManager.V1.Condition) \n\n public sealed class Condition : IMessage\u003cCondition\u003e, IEquatable\u003cCondition\u003e, IDeepCloneable\u003cCondition\u003e, IBufferMessage, IMessage\n\nReference documentation and code samples for the Identity Access Context Manager v1 API class Condition.\n\nA condition necessary for an `AccessLevel` to be granted. The Condition is an\nAND over its fields. So a Condition is true if: 1) the request IP is from one\nof the listed subnetworks AND 2) the originating device complies with the\nlisted device policy AND 3) all listed access levels are granted AND 4) the\nrequest was sent at a time allowed by the DateTimeRestriction. \n\nInheritance\n-----------\n\n[object](https://learn.microsoft.com/dotnet/api/system.object) \\\u003e Condition \n\nImplements\n----------\n\n[IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage-1.html)[Condition](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1.Condition), [IEquatable](https://learn.microsoft.com/dotnet/api/system.iequatable-1)[Condition](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1.Condition), [IDeepCloneable](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IDeepCloneable-1.html)[Condition](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1.Condition), [IBufferMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IBufferMessage.html), [IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage.html) \n\nInherited Members\n-----------------\n\n[object.GetHashCode()](https://learn.microsoft.com/dotnet/api/system.object.gethashcode) \n[object.GetType()](https://learn.microsoft.com/dotnet/api/system.object.gettype) \n[object.ToString()](https://learn.microsoft.com/dotnet/api/system.object.tostring)\n\nNamespace\n---------\n\n[Google.Identity.AccessContextManager.V1](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1)\n\nAssembly\n--------\n\nGoogle.Identity.AccessContextManager.V1.dll\n\nConstructors\n------------\n\n### Condition()\n\n public Condition()\n\n### Condition(Condition)\n\n public Condition(Condition other)\n\nProperties\n----------\n\n### DevicePolicy\n\n public DevicePolicy DevicePolicy { get; set; }\n\nDevice specific restrictions, all restrictions must hold for the\nCondition to be true. If not specified, all devices are allowed.\n\n### IpSubnetworks\n\n public RepeatedField\u003cstring\u003e IpSubnetworks { get; }\n\nCIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for\na CIDR IP address block, the specified IP address portion must be properly\ntruncated (i.e. all the host bits must be zero) or the input is considered\nmalformed. For example, \"192.0.2.0/24\" is accepted but \"192.0.2.1/24\" is\nnot. Similarly, for IPv6, \"2001:db8::/32\" is accepted whereas\n\"2001:db8::1/32\" is not. The originating IP of a request must be in one of\nthe listed subnets in order for this Condition to be true. If empty, all IP\naddresses are allowed.\n\n### Members\n\n public RepeatedField\u003cstring\u003e Members { get; }\n\nThe request must be made by one of the provided user or service\naccounts. Groups are not supported.\nSyntax:\n`user:{emailid}`\n`serviceAccount:{emailid}`\nIf not specified, a request may come from any user.\n\n### Negate\n\n public bool Negate { get; set; }\n\nWhether to negate the Condition. If true, the Condition becomes a NAND over\nits non-empty fields, each field must be false for the Condition overall to\nbe satisfied. Defaults to false.\n\n### Regions\n\n public RepeatedField\u003cstring\u003e Regions { get; }\n\nThe request must originate from one of the provided countries/regions.\nMust be valid ISO 3166-1 alpha-2 codes.\n\n### RequiredAccessLevels\n\n public RepeatedField\u003cstring\u003e RequiredAccessLevels { get; }\n\nA list of other access levels defined in the same `Policy`, referenced by\nresource name. Referencing an `AccessLevel` which does not exist is an\nerror. All access levels listed must be granted for the Condition\nto be true. Example:\n\"`accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME\"`"]]
