Google Workspace Security Checklist for Admins

Most Google Workspace break-ins don’t involve clever hacking. An employee reuses a password, a phishing page captures it, and nothing stops the attacker at sign-in. Or someone clicks “Allow” on a shady app that asks to read all of Drive. Or a file shared as “Anyone with the link” three years ago is still open to the internet.

Every one of those risks has a setting in the Google Admin console. The trouble is that the defaults lean toward convenience, and the settings are spread across the Security, Apps and Devices menus. This checklist puts them in priority order with the menu path for each, so you can work through it in an afternoon.

Google reorganizes the Admin console from time to time. If a path below doesn’t match your screen, type the setting name into the console’s search bar. Some features, such as context-aware access and the security health page, depend on your Workspace edition.

Before you start

Sign in at admin.google.com with a super admin account. Several settings below, including 2-Step Verification enforcement, need super admin rights. Most settings can be applied to the whole organization or to a single organizational unit (OU), so you can test with a small pilot OU first.

Here’s the full list at a glance.

Priority	Area	Setting	Admin console location
1	Sign-in	Enforce 2-Step Verification	Security > Authentication > 2-step verification
2	Admins	At least 2 super admins, separate daily accounts	Account > Admin roles
3	Admins	Recovery info for admins	Directory > Users
4	Third-party apps	Block or limit unconfigured apps	Security > Access and data control > API controls
5	Drive	Default general access set to Restricted, external sharing limited	Apps > Google Workspace > Drive and Docs > Sharing settings
6	Gmail	Turn off automatic forwarding	Apps > Google Workspace > Gmail > End User Access
7	Gmail	SPF, DKIM and DMARC	Apps > Google Workspace > Gmail > Authenticate email, plus your DNS host
8	Monitoring	Alert center and email alerts	Security > Alert center
9	Devices	Mobile and endpoint management	Devices > Mobile & endpoints
10	Groups and Calendar	Admin-only group creation, free/busy-only external calendars	Apps > Google Workspace > Groups for Business and Calendar

Lock down sign-in

Step 1: Enforce 2-Step Verification

2-Step Verification (2SV) is the most important setting on this list. Go to Security > Authentication > 2-step verification, allow users to turn it on, then set Enforcement to On.

Pick a new user enrollment period. Google lets you choose between 1 day and 6 months, during which new staff can sign in with only a password while they set up 2SV. Shorter is safer. A week is usually enough.

Then choose the Methods:

• Any lets people use any method, including text-message codes.
• Any except verification codes via text, phone call removes the weakest options.
• Only security key requires a physical key or a passkey. Google notes this option now accepts passkeys, which give the same phishing protection as hardware keys.

A sensible approach: require “Only security key” for admins and finance staff, and “Any except verification codes via text, phone call” for everyone else. Before you tighten methods, tell users, because anyone still relying on text codes will be locked out once enforcement applies. Our guides to two-factor authentication and passkeys are good to share with staff.

Google is also rolling out mandatory 2SV for admin accounts in stages. Its admin help currently lists Workspace for Education, Workspace for Nonprofits, Cloud Identity, Android Enterprise, and Enterprise editions that use third-party SSO. Super admins get roughly 90 days’ notice. Don’t wait for the notice. Turn it on now.

Step 2: Protect your admin accounts

Google recommends that a business have more than one super admin account, each managed by a separate person, so you’re never locked out if one person leaves or loses access. Google also advises using an account with limited admin roles for day-to-day tasks and saving super admin sign-ins for specific jobs.

In practice:

• Keep 2 or 3 super admins, not 10.
• Give helpdesk staff a prebuilt role such as User Management or Help Desk Admin instead of super admin.
• Don’t use super admin accounts for everyday email and browsing.

Step 3: Add recovery details for admins

Under Directory > Users, make sure every admin has a recovery phone and email. Have admins generate 2SV backup codes and store them somewhere safe and offline. A locked-out super admin with no recovery path is a painful support case.

Control third-party app access

Step 4: Decide which apps can touch your data

Third-party apps that connect with “Sign in with Google” can request access to Gmail, Drive, Calendar and Contacts. A malicious or abandoned app with broad access is a quiet data leak.

Go to Security > Access and data control > API controls, then open App access control. You’ll see apps your users have already connected. For each important one, choose a status:

• Trusted: can access all requested Google data.
• Limited: can access only unrestricted Google services.
• Specific Google data: only the data you pick.
• Blocked: no access.

Next, set Unconfigured app settings to control what happens when users try a new app you haven’t reviewed. Google’s help pages say blocked attempts land in an Apps pending review list, where you can approve, dismiss or block them. Apps you don’t act on drop off that list after 6 months.

Google’s security checklist for larger businesses recommends creating an allowlist of trusted apps for core services. For a small team, a practical policy is: approve the tools you actually pay for, block everything else, and review requests weekly.

What about less secure apps?

You no longer need to switch these off. Google ended support for “less secure apps” that sign in with just a username and password on March 14, 2025. Mail clients and other tools now have to use OAuth to reach Gmail, Calendar and Contacts. If an old scanner or app still sends email by password, check Google’s guidance on moving it to OAuth or SMTP relay.

Tighten Drive and file sharing

Step 5: Set sensible sharing defaults

Drive is where most accidental data exposure happens. Go to Apps > Google Workspace > Drive and Docs > Sharing settings.

Google’s security checklists recommend:

• Setting the default general access for new files to Restricted, so only the creator can open a file until they share it.
• Warning users before they share files outside your organization.
• Limiting external sharing to allowlisted domains (for example, your accountant’s or main client’s domain) if you don’t need open sharing.
• Turning off publishing files to the web if nobody needs it.

If your team regularly shares with outside parties, don’t switch external sharing off completely. People will simply move files to personal accounts. Allowlisted domains plus a warning is usually the right balance.

Key takeaway: The 3 settings that prevent the most damage are enforced 2SV, blocking unreviewed third-party apps, and Drive sharing defaulted to Restricted. Do those first, even if you do nothing else this week.

Secure Gmail

Step 6: Turn off automatic forwarding

Attackers who get into a mailbox often set up a forwarding rule so they keep receiving copies of mail after the password is changed. Go to Apps > Google Workspace > Gmail > End User Access and clear Allow users to automatically forward email to another address. Google notes this is on by default, and turning it off also stops existing forwarding rules and filters from forwarding mail.

If some people genuinely need forwarding, apply the change to everyone except a specific OU.

Step 7: Set up SPF, DKIM and DMARC

These 3 DNS records stop others from spoofing your domain and help your mail reach inboxes. Google warns that without SPF, some of your messages could bounce or land in spam. Generate your DKIM key under Apps > Google Workspace > Gmail > Authenticate email, then add the SPF, DKIM and DMARC records at your DNS host. Our SPF, DKIM and DMARC guide walks through each record.

While you’re in Gmail settings, review the Safety section for attachment and link protections and spoofing warnings, and keep those protections on.

Monitor, manage devices and clean up

Step 8: Turn on alerts

Open Security > Alert center and make sure email notifications go to at least 2 admins for high-risk events such as suspicious sign-ins, government-backed attack warnings, and suspicious forwarding or app activity. Google’s checklist recommends regularly reviewing activity reports and alerts. Put a 15-minute weekly review on your calendar.

If your edition includes the security health page, use it as a scorecard. It compares your settings to Google’s recommendations.

Step 9: Manage phones and laptops

Under Devices > Mobile & endpoints, turn on at least basic mobile management so you can require a screen lock and remotely sign a lost phone out of work accounts. Google publishes a separate device security checklist if you want to go further.

Step 10: Tidy up Groups, Calendar and departing users

• In Groups for Business, allow only admins to create groups and keep groups private to your domain.
• In Calendar sharing settings, limit external sharing to free/busy information.
• When someone leaves, suspend the account, transfer Drive files and reset sign-in cookies the same day. Our employee offboarding IT security checklist covers the full process.

Where to start this week

If you only have an hour, do this:

1. Confirm you have at least 2 super admins and that each has 2SV turned on.
2. Enforce 2SV for all users with a 7-day enrollment window.
3. Block unconfigured third-party apps and approve the ones you use.
4. Set Drive’s default general access to Restricted.
5. Turn off automatic Gmail forwarding.

Next week, add SPF, DKIM and DMARC, set up alert emails, and turn on mobile management. Then train staff to spot fake sign-in pages, since 2SV with text codes can still be phished. Our guides to spotting phishing emails and security awareness training help here.

If you also run Microsoft tools, the same priorities apply. See our Microsoft 365 security checklist.

The bottom line

Google Workspace is secure by design, but its defaults favor easy sharing and easy sign-in. A few changes in the Admin console close the biggest gaps: enforced 2SV with phishing-resistant methods for admins, controlled third-party app access, Restricted Drive defaults and no silent email forwarding. Add email authentication and a weekly look at alerts, and you’ll have covered the attacks that hit small and mid-sized businesses most often.

Sources

• Google Workspace: Security checklist for small businesses (1–100 users) — multiple super admins, limited daily admin roles, Restricted Drive defaults, SPF
• Google Workspace: Security checklist for medium and large businesses — third-party app allowlists, blocking automatic forwarding, Groups and Calendar sharing, alerts
• Google Workspace: Deploy 2-Step Verification — menu path, 1-day to 6-month enrollment period, method options, passkey support
• Google Workspace: About 2SV enforcement for admins — editions with mandatory admin 2SV and notice periods
• Google Workspace Admin Help: Control which third-party and internal apps access Google Workspace data — API controls, app access statuses, unconfigured apps
• Google Workspace: Transition from less secure apps to OAuth — end of less secure app access on March 14, 2025