Google Workspace Changes

Admins can now assign mobile device management privileges based on specific organizational units (OUs).

Google Workspace is providing admins with more granular control over mobile device management by allowing privileges to be delegated for specific organizational units (OUs). This feature, which was previously in beta, is now generally available and includes enhancements to the device display to help admins manage their devices more efficiently.

Google Workspace admins can now use incremental exports for organizational data backups to Google Cloud Storage.

Google Workspace administrators can now utilize incremental exports to back up organizational data for Gmail, Drive, and Chat into their own Google Cloud Storage (GCS) buckets. This feature allows for periodic full backups (quarterly, semi-annually, or annually) and frequent incremental backups, reducing storage costs and completion times while mitigating data loss risks. The feature is available for Enterprise Plus customers with Assured Controls and Assured Controls Plus.

Expanded Admin password reset alerts to cover all administrator roles.

Google is expanding the 'Super Admin password reset' alert in the Alert Center to a broader 'Admin password reset' alert. Previously, alerts were only triggered for super admin password changes; now, the alert covers password resets for all administrator roles within an organization. This update is enabled by default and provides admins with increased visibility and control over privileged accounts to better respond to potential compromises.

Introducing mutate endpoints (Create, Update, Delete) for DLP rules and detectors in the Workspace Policy API.

Google is introducing mutate endpoints (Create, Update, Delete) to the Workspace Policy API for data loss prevention (DLP) rules and detectors. This update allows super admins to programmatically manage and fully automate the entire lifecycle of their DLP policies, from initial creation to real-time activation and deactivation, complementing the existing read-only capabilities.

New data loss prevention (DLP) capabilities for file attachments and proximity conditions are now generally available.

Google Workspace has introduced new DLP rules that allow administrators to target non-Workspace file attachments based on file names, extensions, and custom MIME types. Additionally, proximity matching is now available, enabling the detection of sensitive information when two predefined data types or strings appear within a specified distance (up to 1,000 characters) of each other. These rules can be applied across Gmail, Drive, and Chat to reduce false positives and better secure proprietary or financial data.

Google Workspace expands Out-of-Domain file-level warnings to mobile apps, Chat Spaces, Google Groups, external service accounts, and email notifications.

Google has introduced several improvements to Out-of-Domain file-level warnings to help prevent accidental data exfiltration and phishing attacks. The 'External' badge is now available in Android and iOS apps for Drive, Docs, Sheets, and Slides. Additionally, the badge now triggers for documents shared via Chat Spaces and Google Groups with external users, documents accessed by external Google Cloud service accounts, and within both comment and file sharing email notifications.

Administrators can now apply a global context-aware access (CAA) policy to all SAML applications.

Google Workspace has introduced a default context-aware access (CAA) policy for all SAML applications, establishing a universal security baseline. This 'secure-by-default' posture automatically protects any SAML-based app that lacks a specific policy, reducing the administrative burden of manual configuration. The global policy supports both Monitor and Active modes, while specific application-level policies continue to take precedence for granular control. Admins can configure these settings in the Admin console under Security > Context-aware Access > General settings.

Small businesses can now seamlessly import up to 10 users from Microsoft to Google Workspace during setup.

Google Workspace has introduced a beta feature allowing very small and small-sized businesses and educational institutions to automatically import up to 10 users from Microsoft during the initial account setup process. After connecting to a Microsoft business account and completing domain verification, admins can import users in a single click. Additionally, emails, calendars, contacts, and OneDrive files can be migrated using the data import tool in the Admin console.

Introduction of the AI control center in the Admin console for managing AI and agent access to Workspace data.

Google has introduced the AI control center within the Admin console, providing enterprise organizations with a centralized dashboard to manage security, governance, and auditing for generative AI and agentic solutions. The center features four core modules to monitor AI access, manage product-specific security, handle fundamental security protections like classification labels, and review privacy and compliance standards. It is available for Enterprise Standard and Plus users.

Upcoming Photos management and bulk-deletion capabilities for admins.

Later this year, Google will introduce new Photos management and bulk-deletion tools in the admin console. These capabilities will provide administrators with better visibility into user data migration and allow them to proactively manage Photos content to optimize pooled Drive storage.

Introduction of comprehensive user device information in audit logs and reporting APIs.

Administrators can now access the 'User device info' attribute to gain context about the devices used to perform actions, including User device ID, OS version, and device type (e.g., DESKTOP_MAC). This information is available for numerous log sources and can be accessed via the Security Investigation tool, Admin SDK (Reports API), SecOps, and BigQuery.

Expanded coverage for resources and actor application info in security and audit tools.

Google is expanding two critical attributes in the Security Investigation and Audit and Investigation tools to provide a more complete view across Workspace services. The 'Resources' attribute is expanding to include Chrome, Voice, Vault, and Assignment log events, while 'Actor application info' is expanding to Chrome, Voice, Group, Meet, Assignments, and Admin data action log events.

Introduction of owner details for resource attributes in Workspace audit logs.

Google is adding a new 'Owner details' field to the 'Resources' attribute in Workspace audit logs to help administrators identify who owns a resource during security investigations. This field consists of 'Owner Type' (User, Customer, or Group) and 'Owner Identity' (IDs or email addresses) and will be available across various data sources including Gmail, Drive, Chat, and Meet.

New migration planning utility to help enterprises forecast and organize data migrations.

A new migration planning utility is now available to assist customers with change management and data migration forecasting. The utility provides migration timeline estimates and organizes user data into speed-optimized batches, enabling data-driven planning for large-scale enterprise migrations from Microsoft 365 to Google Workspace.

Introducing Data import, a new tool for easier, faster, and higher-fidelity enterprise data migrations to Google Workspace.

Google Workspace has launched 'Data import', a cloud-native migration tool accessible directly from the Admin console. This tool enables enterprise organizations to migrate emails, calendars, and contacts from Microsoft Exchange Online with increased speed and accuracy at no additional tool or infrastructure cost. It is designed to reduce business disruption and free up IT bandwidth during large-scale migrations.