Google Workspace ships with defaults chosen to get a business running quickly, not to keep it safe. That is a reasonable trade for Google to make and a bad one for you to leave in place. Everything below is a console setting, not a purchase.
Two-step verification, enforced
Making it available is not the same as enforcing it. Until enforcement is on, adoption sits wherever staff left it, which is usually low. Enforce it for everyone, with a short grace period for enrolment.
- Enforce for all users, not just administrators
- Require security keys for super-admin accounts, which resist phishing in a way codes do not
- Disable SMS as a method where you can, since it is the weakest option still commonly offered
- Keep at least two admin accounts enrolled, so losing one device does not lock you out of the tenant
Sharing defaults
This is the setting most often left wrong, and the one most likely to leak a document. Out of the box, a Workspace tenant can be more permissive about external sharing than most businesses expect.
| Setting | Default risk | Recommended |
|---|---|---|
| External sharing | Often broader than intended | Restrict to allow-listed domains where practical |
| Link sharing default | Can default to anyone with the link | Restricted to named recipients |
| Shared drive membership | Managers can add externals | Restrict to administrators |
| Access expiry | No expiry | Set expiry on external access |
Third-party app access
By default users can often grant third-party applications access to their Google account, including mail and files. That is a genuine data-exfiltration route and one that no firewall will see. Restrict app access to reviewed applications and require admin approval for anything requesting sensitive scopes.
The route nobody watches
OAuth app access is the control most often overlooked in a Workspace tenant. A user approving a convenient-looking app can hand over mailbox access without any password being compromised.
Admin role separation
- Nobody should do daily work signed in as super-admin
- Use delegated admin roles scoped to what each person actually needs
- Keep a break-glass super-admin account, documented and stored securely, excluded from routine use
- Alert on new admin role assignments, since privilege escalation is what an attacker does after the first foothold
Alerts that reach a person
Workspace can alert on suspicious sign-ins, mass downloads and admin changes. Configure them and route them to a named individual rather than a shared mailbox. An alert nobody reads is worse than no alert, because it creates the impression of monitoring.
Data that survives an employee leaving
Company files belong in shared drives, which are owned by the organisation, rather than in My Drive, which is owned by the user. Configure this at deployment. Fixing ownership after two years of files landing in personal drives is a substantially larger job.
Inherited a Workspace tenant?
We audit existing Google Workspace tenants against this baseline and fix what is open, without disrupting how your staff work.
