Google Workspace Security Checklist: 40 Admin Console Settings and Best Practices (2026)

A Google Workspace security checklist is mostly a list of Admin console settings, and the attacks that matter turn on a handful of them. Two of the riskiest ship open: by default, users can connect any third-party app and automatically forward their mail. Below are 40 checks, each with where the setting lives, the edition it needs and how to verify it, current as of November 2026.

To have it checked for you, our Google Workspace and Microsoft 365 security assessment reviews these settings by hand with read-only access, from $4,200 for one tenant of up to 250 users (assessment pricing). Running Microsoft instead? See our Microsoft 365 security best practices checklist.

How Google Workspace accounts actually get compromised

Workspace breaches rarely involve a flaw in Google’s code. They start with a sign-in, a consent screen or a token, and the usual payoff is a quiet copy of someone’s mailbox, then a fake change of bank details.

Attack path	What happens	Control that breaks it
Password reuse and spraying	A leaked password works where there is no second factor	2SV for every user
Adversary-in-the-middle phishing	A look-alike page passes the sign-in through to Google and keeps the session cookie issued after 2SV (Evilginx explained)	Security keys or passkeys, shorter sessions
Consent phishing	A user approves an app that reads Gmail or Drive; a password change revokes mail-scope tokens, not every grant (token revocation, malicious connected apps)	Unconfigured apps blocked
Stolen integration tokens	A breached vendor’s OAuth tokens are reused to read your mail, as UNC6395 did through the Salesloft Drift integration in August 2025 (Google Threat Intelligence)	App inventory with owners, narrow scopes
Mailbox staging for fraud	A forwarding address quietly copies invoice threads outside	Forwarding off and alerted
Domain-wide delegation abuse	A leaked service account key acts as any user	Few delegation clients, narrow scopes

Google Workspace security best practices: the ten fixes to make first

1. Enforce 2-Step Verification for everyone, without text or voice codes.
2. Require security keys or passkeys for admins.
3. Keep super admins few, named and on admin-only accounts.
4. Stop allowing every unconfigured third-party app.
5. Restrict Gmail and Drive to trusted apps; review existing grants.
6. Turn off automatic forwarding and find forwarding already set up.
7. Move DMARC toward quarantine or reject.
8. Set Drive general access to Restricted.
9. Delete unused domain-wide delegation clients.
10. Export audit logs before six-month retention drops them.

The Google Workspace security checklist

This list follows Google’s own security checklist for medium and large businesses, reordered by attack path. In the Edition column, Any means every edition, Business Standard+ and Business Plus+ mean that edition or higher, and Enterprise means Enterprise Standard or Plus and their Education and Frontline equivalents.

Super admins and admin roles

#	Check	Where	Edition	How to verify
1	More than one super admin, each a named person, no more than needed	Account > Admin roles	Any	Every assignment maps to a current employee
2	Super admins use a separate, admin-only account	Directory > Users	Any	No super admin account has a busy inbox
3	Routine work done through limited roles	Account > Admin roles	Any	Help desk staff hold limited roles
4	Security keys or passkeys for every admin	Security > Authentication > 2-step verification: “Only security key” for an admin organizational unit or configuration group	Any	Admin sign-ins show a security key
5	Super admins in the Advanced Protection Program	Security > Authentication	Any	User log events show titanium_enroll
6	Super admin self-recovery off; spare security key and printed backup codes stored safely	Security > Authentication > Account recovery	Any	“Allow super admins to recover their account” unchecked
7	Vault privileges treated like super admin	Account > Admin roles	Business Plus+	Vault access limited to named staff

Checks 1 to 6 come from Google’s best practices for administrator accounts, which notes that super admin self-recovery is off by default for most customers but still on for some older tenants; with it on, a compromised recovery phone or email hands over the tenant. Google is also phasing in mandatory 2SV for administrators, so enroll yours first.

Sign-in and 2-Step Verification

#	Check	Where	Edition	How to verify
8	2SV enforced for every user, not merely allowed	Security > Authentication > 2-step verification	Any	Enforcement On at the top organizational unit
9	Methods: “Any except verification codes via text, phone call”	Same page	Any	No user depends on SMS codes
10	Short new-user enrollment period; “Allow user to trust the device” off	Same page	Any	New starters enroll in week one
11	App passwords reviewed	Directory > Users > user > Security	Any	Only documented app passwords remain
12	POP and IMAP off where no desktop client needs them	Gmail > End User Access	Any	Only named units keep IMAP
13	Web session length set deliberately, shorter for admins	Security > Access and data control > Google Session control	Business Plus+	The value is a decision, not the default
14	Context-Aware Access on Gmail, Drive and other core apps	Security > Access and data control > Context-Aware Access	Enterprise	An unmanaged laptop cannot open Drive
15	With a third-party identity provider, post-SSO verification on	Security > Authentication > Login challenges	Any	Admins get a Google 2SV prompt after SSO

Google ended less secure app access, including password-only IMAP, POP and SMTP, on May 1, 2025 (Google Workspace Updates), but app passwords are exempt (Google’s transition notice). An app password signs in without a second factor (check 11), and a stolen session cookie works as long as the session lasts (check 13).

Third-party apps and OAuth

#	Check	Where	Edition	How to verify
16	Unconfigured third-party apps not left at “Allow users to access any third-party apps”	Security > Access and data control > API controls > Settings	Any	Basic Sign in with Google info only, or none
17	Gmail and Drive Restricted, or their high-risk scopes; a named person reviews app requests	API controls > Manage Google Services; Settings	Any	Only Trusted apps hold mail or full Drive access; requests worked weekly
18	Every accessed app with Gmail, Drive or directory access has an owner	API controls > Manage Third-Party App Access	Any	Unknown apps blocked
19	Unused domain-wide delegation clients deleted	API controls > Manage Domain Wide Delegation	Any (super admin)	Each client ID maps to a live system and an owner
20	Marketplace apps and Docs add-ons limited to an allowlist	Apps > Google Workspace Marketplace apps	Any	Only allowlisted Marketplace apps can be installed

By default, users can grant any third-party app access (Google’s API controls). Restricting Gmail and Drive revokes tokens for untrusted apps, but other grants stay until someone works through the accessed-apps list (check 18). Google’s delegation guidance warns that a domain-wide delegated app reaches every user’s data with no consent screen. Old migration tools are the usual leftovers; our cloud security best practices cover the long-lived key hygiene behind them.

Gmail

#	Check	Where	Edition	How to verify
21	Automatic forwarding off	Gmail > End User Access > Automatic forwarding	Any	Exceptions handled as admin routing
22	Forwarding already set up found and removed	Reporting > Audit and investigation > User log events (formerly Login)	Any	Each email_forwarding_out_of_domain event in the six-month log explained; current forwarding checked where allowed
23	SPF complete and DKIM signing on for every sending domain	Gmail > Authenticate email	Any	Headers show DKIM pass for your domain
24	DMARC moving from none toward quarantine or reject	Public DNS	Any	Aggregate reports show only known senders
25	Spoofing protections set to quarantine or spam, not the default warning	Gmail > Safety	Any	A spoofed test of your domain is quarantined; future recommended settings applied
26	Attachment and link protections on	Gmail > Safety	Any	“Apply future recommended settings” ticked for attachments and for links
27	Enhanced pre-delivery scanning and external recipient warnings on; no spam bypass for allowlisted senders or IPs	Gmail > Spam, phishing and malware; End User Access (Warn for external recipients)	Any	Approved sender lists empty or justified
28	Delegation, admin routing and email monitors reviewed on finance and executive mailboxes	Gmail > User settings; Routing	Any	Every delegate and destination is current

Automatic forwarding is on by default; Google’s checklist recommends turning it off, along with POP and IMAP. A setting change is not an audit, hence check 22. Our spear phishing guide covers the invoice and payroll pretexts forwarding feeds.

Drive, Groups, Calendar and Chat

#	Check	Where	Edition	How to verify
29	External sharing limited to allowlisted domains or warned; external collaborators must sign in with a Google account	Drive and Docs > Sharing settings	Any	Outside shares warn; personal addresses must sign in
30	General access defaults to Restricted; publishing to the web off; Access Checker set to recipients only	Same page	Any	New files are not “Anyone with the link”
31	Shared drives block external sharing and moving content out by default	Sharing settings > Shared drive creation; Sharing options > Distributing content outside	Business Standard+	New shared drives start restricted
32	No public access to internal groups; group creation limited	Groups for Business	Any	No internal group is readable from outside
33	Calendar shared externally as free/busy only; external Chat limited to allowlisted domains	Calendar; Google Chat	Any	An outside account sees busy blocks only

Devices, passwords, data and logging

#	Check	Where	Edition	How to verify
34	Mobile management on, device passwords required, remote account wipe ready	Devices > Mobile & endpoints > Settings	Any	A lost phone’s Workspace account can be wiped
35	“Enforce strong password” and a minimum length set, with “Enforce password policy at next sign-in” on	Security > Authentication > Password management	Any	Users with weak passwords must change them at next sign-in
36	Data loss prevention rules on Drive and Gmail for regulated data	Rules > Create rule > Data protection	Enterprise	A test file with a dummy card number is blocked or warned
37	Google Takeout off for users with no reason to export everything	Google Takeout settings	Any	Only named units can export
38	Offboarding resets sign-in cookies, revokes OAuth tokens and app passwords, removes recovery details	Directory > Users > user > Security	Any	A leaver shows no live tokens
39	Alerts on the audit events listed below reach a person	Security > Alert center, or your SIEM	Any	A test forwarding change alerts within the hour
40	Audit logs exported before retention runs out	BigQuery export, or the Reports API	Enterprise for BigQuery	Last year’s admin events are searchable

Two controls for regulated data sit beyond the 40. Client-side encryption, where your organization uses its own encryption keys, is limited to Frontline Plus, Enterprise Plus, Education Standard and Education Plus. Vault retention rules matter wherever Vault is licensed: without one, Google says data stays in user accounts until the user or admin deletes it, and holds take precedence over retention rules.

Google Workspace security checklist for small teams

On Business Starter, 34 of the 40 checks apply as written, because their Edition column says Any. The other six need a higher edition, as Google’s Business edition comparison shows: Vault (check 7) and web session length (13) need Business Plus, shared drive sharing defaults (31) need Business Standard, and Context-Aware Access (14), data loss prevention (36) and BigQuery export (40) are not in any Business edition.

A team of ten should make the ten fixes above first, then cover the gaps with what Starter includes: fundamental endpoint management for lost phones (check 34), the Alert center for check 39, and the Reports API in place of BigQuery. Small nonprofits are in the same position, usually with no security staff; our page on penetration testing for nonprofits covers that case.

Google Workspace audit events worth an alert

Event names are Admin SDK Reports API names; Reporting > Audit and investigation shows readable labels (login, admin and token references).

Signal	Log	Event name	What it usually means
Out-of-domain forwarding enabled	Login	email_forwarding_out_of_domain	Mail copied outside for invoice fraud
Admin routing or email monitor added	Admin	MAIL_ROUTING_DESTINATION_ADDED, CREATE_EMAIL_MONITOR	A silent mailbox copy set by an admin
Recovery details changed	Login	recovery_email_edit, recovery_phone_edit	Persistence through account recovery
Suspicious sign-in, leaked password or session cookie	Login	suspicious_login, account_disabled_password_leak, user_signed_out_due_to_suspicious_session_cookie	Spraying, reuse, a breached credential or a replayed session
App granted access	OAuth	authorize, with app_name and scope	Consent phishing or an unreviewed integration
Admin rights or domain-wide delegation granted	Admin	GRANT_ADMIN_PRIVILEGE, ASSIGN_ROLE, AUTHORIZE_API_CLIENT_ACCESS	Privilege escalation, or access to every user’s data
2SV or other controls loosened	Login, Admin	2sv_disable, TURN_OFF_2_STEP_VERIFICATION, ENFORCE_STRONG_AUTHENTICATION, ADD_TO_TRUSTED_OAUTH2_APPS, CHANGE_SSO_SETTINGS	Someone removing 2SV, trusting a risky app or redirecting sign-in

The six-month logging trap

Google keeps Admin, user log (formerly Login), Gmail, Drive, OAuth and SAML events for six months, and email log search covers 30 days; admins cannot extend either (Google’s retention table). Invoice fraud often surfaces later.

Enterprise editions can export activity logs to BigQuery; turn it on early and change the table expiration on day one, since Google says exported data expires after 60 days by default. Business editions can pull the same events through the Reports API into a SIEM.

Google Workspace security assessment options compared

Option	What it tells you	What it misses
Google’s security health page and dashboard (Enterprise editions only)	Settings that differ from Google’s recommendations	Existing app grants and forwarding
CIS Google Workspace Foundations Benchmark, or CISA’s free ScubaGoggles tool and Google Workspace Secure Configuration Baselines	An auditable list, or an automated check against federal baselines	Priority by attack path
Manual review, plus attack simulation from a compromised user	Every check verified by hand, and what one phished account reaches	Controls the path never touches

Gemini and AI app controls

Gemini has its own Admin console settings, and they deserve the same review as third-party apps. They are not among the 40 numbered checks, but verify three things:

• Who has the Gemini app. Under Generative AI > Gemini app, Google says the app is available by default to all licensed users over 18, and the setting can be applied per organizational unit or group. It covers gemini.google.com, the mobile apps and Gemini in Chrome (Google’s instructions).
• Whether the Gemini app can reach Workspace data. In the same menu, the Workspace apps setting lets users connect services such as Gmail, Drive and Calendar to the Gemini app, and it is on by default.
• Other AI apps. A third-party assistant that asks for Gmail or Drive scopes is an OAuth app like any other, so checks 16 to 18 decide whether users can connect it.

Beyond the Admin console

• Gemini. Google says Gemini only retrieves content the user can already open, so a file shared domain-wide is one question away for everyone. Fix sharing before a wide rollout; a shared file can also carry instructions the assistant follows (indirect prompt injection).
• Google Cloud. The projects and service account keys behind domain-wide delegation belong in a cloud penetration test, from $6,800 (cloud penetration testing cost, GCP testing guide).
• People. Settings do not stop an employee approving a wire. A phishing simulation, from $3,600 (phishing simulation pricing), reports click and credential-entry rates by department.

How Invadel tests Google Workspace, and what it costs

Our Google Workspace security assessment works through this checklist by hand from a read-only admin role you grant, and changes nothing in the tenant. Google Workspace and Microsoft 365 share the same tiers and prices.

Tier	What we do in your Workspace	Price	Report
One tenant, up to 250 users	All 40 checks by hand, including existing app grants, forwarding and delegation clients	$4,200	1 to 2 weeks after access
A past takeover attempt, or 251 to 1,000 users	The review, plus what one phished account reaches, attacked from a test account you designate	$6,800	2 to 3 weeks
Several tenants or domains, or over 1,000 users	Built around your scope	Quoted, fixed before work	Typically 3 to 4 weeks

You receive executive and technical reports benchmarked against the CIS Google Workspace benchmark, an attestation letter and findings-platform access, and once fixes are in, we retest them free. Onboarding starts within a day of signing. See the Google Workspace assessment pricing page or a sample report.

Compliance and cyber insurance

For financial firms that run on Workspace, 2SV everywhere can be a legal requirement, not only a best practice. The FTC Safeguards Rule, 16 CFR 314.4(c)(5), requires the financial institutions it covers to use multi-factor authentication for any individual accessing any information system, unless their Qualified Individual approves reasonably equivalent or more secure controls in writing (FTC Safeguards Rule testing). New York’s 23 NYCRR 500.12 has required much the same of DFS-regulated companies since November 1, 2025 (DFS guidance, NYDFS Part 500 testing). SOC 2 auditors (CC6.1) and cyber insurers check 2SV coverage too, and our SOC 2 penetration testing page covers how a penetration test supports that audit.

Frequently asked questions

What are the most important Google Workspace security best practices? The ten fixes above: 2SV for everyone with security keys for admins, few super admins, restricted third-party apps, no automatic forwarding, Restricted Drive sharing, DMARC enforcement and exported logs.

Is Google Workspace secure by default? Not fully. Google secures the platform, but several tenant defaults favor convenience: users can connect any third-party app, automatic forwarding is on, and the Gemini app can connect to Workspace data. 2-Step Verification is available in every edition but has to be enforced by an admin.

Do we need an Enterprise edition to secure Google Workspace? No. Business Starter and Standard can apply most of this checklist. Business Plus adds Vault and session control; Enterprise adds Context-Aware Access, data loss prevention, the security health page and dashboard, and BigQuery log export.

Can we penetration test our own Google Workspace tenant? Yes, within your own tenant and Google’s terms and acceptable use policy. A configuration review only reads settings; an attack simulation starts from a test account you designate and phishes only users you authorize in writing.

How much does a Google Workspace security assessment cost? Google Workspace is priced the same as Microsoft 365 at Invadel: $4,200 to review one tenant of up to 250 users, $6,800 with an attack simulation or for 251 to 1,000 users, and a fixed quote for larger scopes, each with a free retest.

The short version

Google Workspace is rarely breached through Google; it is breached through a weak second factor, an approved app, an unnoticed forwarding rule or a forgotten delegation client. The ten fixes close those four gaps; the full checklist keeps them closed. For a fixed-price review of your tenant with a free retest, see the Google Workspace security assessment and its pricing, or scope your tenant.