Google Workspace Changes

New admin settings to control user ability to add account recovery email and phone information.

Google is introducing two new settings in the Admin console that allow administrators to control whether users can add recovery email and phone information to their Google Workspace accounts. These settings can be configured at the organizational unit (OU) and group levels under Security > Account Recovery > Recovery information, helping organizations balance account security with local privacy regulations like GDPR.

Open beta for custom OpenID Connect (OIDC) profiles for Single-Sign On (SSO).

Google Workspace admins now have the option to set up custom OpenID Connect (OIDC) profiles for single sign-on (SSO) with Google as the Service Provider. This update expands authentication options beyond SAML and pre-configured Microsoft Entra ID profiles, allowing admins more flexibility in how end users access cloud applications using a single set of credentials.

Groups Editor and Groups Reader roles are now generally available for specific group types.

Google Workspace has announced the general availability of the Groups Editor and Groups Reader roles, which can now be provisioned for specific group types, such as security groups or non-security groups. These roles provide delegated admin permissions, allowing administrators to use conditions to limit access to sensitive groups as needed.

General availability of configuring third-party apps by select API scopes.

Google Workspace admins can now limit third-party app access to specific OAuth 2.0 scopes for Google APIs, such as Drive or Gmail. This provides more granular control and prevents apps from gaining additional access without admin consent, even if new scopes are requested in the future, ensuring data access is restricted to only what is necessary.