組織限制功能可防止透過網路釣魚或內部攻擊竊取資料。如果是機構中受管理的裝置，組織權限限制功能只會限制存取授權 Google Cloud 機構中的資源。
機構限制的運作方式
在 Google Cloud中，Identity and Access Management (IAM) 可控管資源存取權。管理員可使用允許和拒絕政策，控管哪些使用者可以存取機構內的資源。機構必須限制員工只能在已授權的機構中存取資源。 Google CloudGoogle Cloud 管理員 (負責管理) Google Cloud和輸出 Proxy 管理員 (負責設定輸出 Proxy) 應共同參與組織權限限制設定作業。
下圖說明各元件如何運作，以強制執行機構限制：
架構圖顯示下列元件：
受管理的裝置：由公司機構政策規範的裝置。機構員工使用受管理的裝置存取機構資源。
輸出 Proxy：輸出 Proxy 管理員會設定 Proxy，在受管理裝置發出的任何要求中加入機構限制標頭。這項 Proxy 設定能防止使用者在非授權的機構中存取任何 Google Cloud 資源 Google Cloud 。
Google Cloud： Google Cloud 的機構權限限制功能會檢查所有要求的機構權限限制標頭，並根據要存取的機構允許或拒絕要求。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Introduction to organization restrictions\n\nThis page provides an overview of organization restrictions and how it works.\n\nThe organization restrictions feature lets you prevent data exfiltration\nthrough phishing or insider attacks. For managed devices in an organization, the organization restrictions\nfeature restricts access only to resources in authorized Google Cloud organizations.\n\nHow organization restrictions works\n-----------------------------------\n\nIn Google Cloud, Identity and Access Management (IAM) governs access to resources.\nAdministrators use allow and deny policies to control who can access the\nresources within their organization. There is a need in organizations to\nrestrict access of their employees only to resources in authorized Google Cloud\norganizations. Google Cloud administrators who administer Google Cloud, and\negress proxy administrators, who configure the egress proxy, engage together to\nset up organization restrictions.\n\nThe following diagram illustrates how the different components work to enforce organization restrictions:\n\nThe architecture diagram shows the following components:\n\n- **Managed device**: A device that is governed by the organization policies of\n a company. Employees of an organization use a managed device to access the organization\n resources.\n\n- **Egress proxy**: An egress proxy administrator configures\n the proxy to add organization restrictions headers to any requests originating\n from a managed device. This proxy configuration prevents\n users from accessing any Google Cloud resources in non-authorized Google Cloud organizations.\n\n- **Google Cloud**: The organization restrictions feature in Google Cloud inspects all requests\n for organization restrictions header, and allows or denies the requests based on\n the organization being accessed.\n\nCommon use cases\n----------------\n\nHere are some common organization restrictions use cases:\n\n- Restrict access to employees in your organization so that employees can\n [access resources only in your Google Cloud organization](/resource-manager/docs/organization-restrictions/examples-org-restrictions#access-your-org)\n and not other organizations.\n\n- [Allow your employees to read from Cloud Storage resources](/resource-manager/docs/organization-restrictions/examples-org-restrictions#access-read-org)\n but restrict employee access only to resources in your Google Cloud organization.\n\n- [Allow your employees to access a vendor Google Cloud organization](/resource-manager/docs/organization-restrictions/examples-org-restrictions#access-vendor-org) in addition\n to your Google Cloud organization.\n\nImplementing these use cases require engagement between Google Cloud administrators,\nwho administer Google Cloud, and egress proxy administrators who configure the egress proxy.\n\nWhat's next\n-----------\n\n- Learn about [organization restrictions configuration](/resource-manager/docs/organization-restrictions/configure-organization-restrictions).\n- Learn about the [services supported by organization restrictions](/resource-manager/docs/organization-restrictions/supported-services)."]]
