Google Workspace is usually the single largest concentration of an organisation’s sensitive information. A short list of admin settings does most of the protective work, and they are worth doing in the first hour rather than the first quarter.
1. Two-step verification
Enable it, then enforce it. Enabling without enforcing means only the diligent turn it on.
- Enforce for administrators immediately.
- Roll out to all users with a clear enrolment deadline.
- Prefer security keys or the Google prompt over SMS.
- Distribute backup codes so enforcement does not create lockouts.
2. Protect the super administrator
Super admin can do everything, including undoing your other controls.
- Create at least two super admins so one lost account is not a lockout.
- Keep the number small and review it periodically.
- Give day-to-day admins delegated roles instead, scoped to what they actually manage.
- Do not use a super admin account for ordinary mail and browsing.
- Store recovery information somewhere the organisation controls, not one person’s phone.
3. Sharing defaults
Drive’s default sharing behaviour decides how much leaks by accident.
- Decide whether external sharing is allowed at all, and for whom.
- Turn off “anyone with the link” as a default if your data warrants it.
- Use shared drives for organisational documents so files survive an employee leaving.
- Set link expiry where the edition supports it.
Files in someone’s My Drive leave with them. This is the single most common cause of lost institutional knowledge after a departure.
4. Access to third-party apps
OAuth grants to third-party applications are a real risk: a user can hand broad mailbox access to an unvetted tool in two clicks.
- Restrict third-party app access to an allowlist for sensitive scopes.
- Review connected applications periodically.
- Block or restrict less secure app access.
5. Audit logs and alerts
Turn on the alert centre and configure alerts for suspicious sign-ins, admin role changes and unusual external sharing. Audit logs only record what happened after you enabled them, so enable early.
Where the edition supports exporting logs, send them somewhere outside Workspace. An audit trail an attacker can also delete is limited.
6. Mail security
- Enable enhanced pre-delivery scanning.
- Turn on external sender warnings so spoofing attempts are visible.
- Publish SPF, DKIM and DMARC, and move DMARC to enforcement once reports are clean. See authentication setup.
7. Offboarding
Have a documented process: suspend rather than delete first, transfer Drive ownership, reset sign-in cookies, remove from groups, and only then delete once retention allows.
Our Google Workspace listings cover inbox-supported and non-profit 300 seat configurations. Migration sequencing is in the migration guide.
Common questions
Which settings should I do first?
Two-step verification enforcement and a second super admin. Everything else is easier afterwards.
Are all controls available on every edition?
No. Data loss prevention, context-aware access and Vault depend on edition. See editions and seats.
What happens to files when someone leaves?
My Drive files go with the account unless transferred. Shared drive files belong to the organisation.