Visit the Google Workspace Official Website here

Table of Contents

When you first set up Google Workspace, it is relatively easy to get started with basic tasks such as adding users, configuring Gmail, and sharing files in Google Drive. What is easier to overlook is security configuration in the Google Workspace Admin Console.

Google Workspace already includes many built-in security protections by default, but if you are using it for a business or organization, there are several settings administrators should review carefully, including 2-Step Verification, admin privileges, Google Drive external sharing, Gmail authentication, third-party app access, device management, and audit logs.

This is especially important because Google Workspace is not just Gmail. A single Google account may also provide access to Drive, Docs, Meet, Chat, Calendar, and other business data. If one account is compromised, the impact may extend beyond email to internal files, shared drives, and other company resources.

In this guide, I will walk through the first security settings Google Workspace administrators should review in the Admin Console. See our overview of Google Workspace features for the bigger picture.

Note

This article is based on Google's official information as of August 2026. Google Workspace features and Admin Console menus change regularly, so always check the latest Google documentation when applying settings.

Google Workspace Security Settings to Review First

Here is a quick overview of the most important items.

SettingPriorityMain Purpose
2-Step Verification★★★Prevent account takeover
Admin account protection★★★Reduce organization-wide risk
SPF, DKIM, and DMARC★★★Prevent email spoofing
Drive external sharing★★★Reduce data leakage
Third-party app access★★☆Reduce OAuth-related data exposure
Advanced Gmail protection★★☆Phishing and malware protection
Device management★★☆Protect company data on lost devices
Audit logs★★☆Investigate suspicious activity
Security Center★★☆Monitor security risks
Ransomware protection★★☆Protect Drive files

If you do not have time to review everything immediately, I would start with these four: 2-Step Verification, admin accounts, email authentication, and Google Drive external sharing.

1. Enable 2-Step Verification

One of the first security settings to review in Google Workspace is 2-Step Verification. If users can sign in with only a password, a leaked password may be enough for an attacker to access the account.

With 2-Step Verification enabled, users need an additional authentication method, such as a smartphone, a security key, a passkey, or another approved second factor. Google has also strengthened 2-Step Verification requirements for administrator accounts. Because administrators have significantly more privileges than ordinary users, protecting those accounts is especially important (see "About 2SV enforcement for admins").

Do Not Protect Only Admin Accounts

A common approach is: "As long as the administrator accounts use 2-Step Verification, we should be fine." Protecting administrators should absolutely be the first priority.

Key Takeaway

However, ordinary user accounts may still contain access to Gmail, Google Drive, Google Calendar, Google Chat, and Google Docs. If possible, it is safer to enforce 2-Step Verification across the entire organization rather than only for administrators.

2. Do Not Use a Super Admin Account for Everyday Work

Google Workspace uses the term Super Admin for accounts with the highest level of administrative privileges. A Super Admin can manage users, reset passwords, change security settings, configure apps, manage domains, and change administrator privileges. That level of access is useful, but it also means that a compromised Super Admin account can have a much larger impact on the organization.

Key Takeaway

For that reason, I recommend not using a Super Admin account for everyday email, document editing, or general work. A better setup is to separate your everyday user account from your administrator account. This reduces the amount of time the highly privileged administrator account is exposed during normal daily activity.

It is also a good idea not to rely on a single Super Admin. If the only Super Admin leaves the company, loses access to the account, or experiences another account problem, recovering administrative access can become much more difficult.

3. Configure SPF, DKIM, and DMARC

If you use Gmail with your own company domain, email authentication should be high on your checklist. The three technologies you will most commonly see are:

  • SPF: specifies which mail servers are authorized to send email on behalf of your domain.
  • DKIM: adds a digital signature to outgoing email so receiving mail systems can verify that the message was not altered and was sent by an authorized system.
  • DMARC: tells receiving mail servers what to do when SPF or DKIM checks fail.

Together, these technologies help prevent attackers from impersonating your company domain. For example, if your company uses example.com, an attacker may attempt to send phishing email that appears to come from someone at example.com. Properly configuring SPF, DKIM, and DMARC makes it easier for receiving email systems to identify those spoofed messages. For any organization using business email, these settings should be treated as a high priority.

4. Review Google Drive External Sharing

Google Drive makes it very easy to share files both inside and outside your organization.

Warning

That convenience can also create security risks. For example, using a setting similar to "Anyone with the link" may allow people outside the intended audience to access a document. This becomes particularly important when files contain customer data, quotes, contracts, internal documents, or development materials.

Rather than simply allowing external sharing everywhere, it is better to establish a clear policy. Depending on your organization, you may choose to block external sharing, allow it only for certain organizational units, display warnings before sharing externally, or apply different restrictions to shared drives. Completely disabling external sharing is not always practical — for many organizations, the better approach is to decide exactly where external sharing is allowed and under what conditions.

5. Review Third-Party App Access

Google Workspace can connect to many third-party services, including CRM systems, Slack, Notion, AI tools, scheduling services, and file management platforms. These integrations often use OAuth, and you may see permission requests such as "Allow this app to access Google Drive?" or "Allow this app to access Gmail?"

The problem is that people often forget about apps after granting access. An application you tested several years ago may still have permission to access Gmail, Google Drive, and Google Calendar.

Tip

It is worth reviewing connected applications regularly and removing anything that is no longer needed. Google Workspace has also moved away from older "less secure app" authentication methods that rely only on usernames and passwords — OAuth and other more secure authentication methods are now required for many third-party integrations (see "Transition from less secure apps to OAuth").

6. Review Gmail Phishing and Malware Protection

Google Workspace Gmail includes strong spam and malware protection by default. However, administrators can also configure additional protections related to spoofing protection, suspicious attachments, dangerous links, encrypted attachments, and untrusted senders. These protections can trigger warnings, quarantine suspicious messages, or apply other controls.

Example

Phishing emails often impersonate services employees use every day. Common examples include messages claiming to be a Google security notification, a Microsoft 365 update, an invoice, a password reset request, or a cloud storage notification. User education is important, but technical protections at the administrator level should also be part of your defense.

7. Review Device Management

Google Workspace is often accessed from smartphones and tablets as well as computers. If an employee uses a mobile device for Gmail, Drive, Calendar, or Chat and then loses that device, company data may be at risk.

Google Workspace includes device management features that can help administrators view device information, restrict access, require screen locks, remove company accounts, and remotely wipe managed data. The exact device management features available depend on your Google Workspace edition — if device security is important to your organization, make sure you understand what is included with Business Starter, Business Standard, or Business Plus.

8. Make Sure You Know Where to Find Audit Logs

Security is not only about preventing an incident. You also need to be able to investigate what happened afterward. Google Workspace provides various logs and reports through the Admin Console, including sign-in activity, administrator actions, Google Drive activity, Gmail, OAuth applications, and devices.

You do not necessarily need to review every log every day. But if something happens — a login from an unfamiliar location, a file being shared unexpectedly, an administrative setting changing without explanation — you should already know where to begin investigating. Being able to find the relevant audit information quickly can make a major difference during a security incident.

9. Review Security Center If Your Edition Includes It

Google Workspace also includes Security Center capabilities for supported editions. Security Center can help administrators identify and monitor suspicious sign-ins, malware, data sharing risks, security alerts, and user-related security risks.

Key Takeaway

However, the available Security Center features depend on your Google Workspace edition. Do not assume that every Google Workspace subscription includes the same set of Security Center tools. Check exactly what is available in your current plan before designing your security operations around it (see "About the security center"). Our Google Workspace security best practices guide also covers how this varies by plan.

10. Google Drive Ransomware Protection Is Also Improving

Google has continued adding AI-powered security capabilities to Google Workspace. Google Drive now includes stronger protections designed to detect suspicious file changes associated with ransomware and help reduce the spread of damage.

It is important not to assume that cloud storage makes ransomware irrelevant. For example, if a ransomware-infected computer encrypts a large number of locally synchronized files, those changes may also be synchronized to cloud storage. That is why ransomware protection should be considered as part of a broader security strategy that includes endpoint protection, Google Workspace security settings, backups, access controls, and user permissions. No single control should be treated as a complete solution.

11. If You Use Gemini, Review Workspace Intelligence Settings

In 2026, Gemini is increasingly integrated across Google Workspace. Depending on your configuration and edition, Gemini may work with information from services such as Gmail, Google Drive, Google Docs, Google Sheets, Google Slides, Google Calendar, and Google Chat.

Administrators can use Workspace Intelligence controls to manage how these features interact with Workspace data (see "Introducing Workspace Intelligence, with admin controls"). For organizations using Gemini, the security question is no longer simply "Should employees be allowed to use AI?" Administrators also need to think about "Which internal information should AI features be allowed to access and use as context?" As Gemini becomes more deeply integrated into Workspace, this is becoming an increasingly important part of Google Workspace administration.

Google Workspace Security Is Not a One-Time Setup

Google Workspace changes frequently. New features are continuously added, particularly around Gemini, Workspace Studio, AI agents, third-party integrations, Google Meet AI features, and AI in Docs and Sheets. New functionality is useful, but it also means that administrators need to keep reviewing who can access what data, from which devices, and through which applications.

Key Takeaway

I recommend periodically reviewing at least user accounts, administrator accounts, 2-Step Verification, external sharing, OAuth applications, devices, and security policies. For many small and midsize organizations, reviewing these areas every six months is a reasonable starting point. Organizations with stricter compliance requirements may need to review them more often.

Conclusion

When organizations first adopt Google Workspace, it is easy to focus on the productivity benefits of Gmail, Google Drive, Docs, Meet, and other tools. But the security settings in the Admin Console are just as important.

The first four areas I would review are 2-Step Verification, admin account protection, SPF/DKIM/DMARC, and Google Drive external sharing. After that, move on to third-party applications, Gmail protection, device management, audit logs, Security Center, ransomware protection, and Gemini and Workspace Intelligence.

Google Workspace includes a strong set of security capabilities, but subscribing to the service does not automatically mean every setting is configured appropriately for your organization. Even simply opening the Admin Console and reviewing your current configuration is a good first step.

The important question is: "Do we actually know how our Google Workspace environment is configured today?" If the answer is no, this checklist is a good place to start. See our Admin Console basics guide for the fundamentals of user and license management.

▶ Check details and free trial on the Google Workspace Official Website