Google Workspace Changes

Streamlined admin controls for Gemini Enterprise are now available in a dedicated Generative AI section of the Admin console.

Google has introduced a new 'Generative AI' subsection in the Google Workspace Admin console to centralize the management of Gemini Enterprise. This update redirects existing settings from the Google Cloud Platform app to this new section, allowing administrators to manage service on/off toggles and data sharing configurations in one place while maintaining granular control over Workspace data access based on specific licenses.

Admins can now download third-party attestations for Google Workspace data regions.

Google Workspace admins using Assured Controls or Assured Controls Plus can now access and download an independent review from Coalfire, a third-party assessment organization. This attestation verifies that data is stored and processed within the assigned Google data center region, providing customers with external validation of Google's implementation of data residency controls.

Enhanced log filtering for Resource fields in the security investigation tool for Gmail and Google Drive.

The security investigation tool now features improved filtering for the Resources attribute for Gmail and Google Drive log events. This allows administrators to perform more granular searches using classification labels to identify sensitive content and enforce security policies, as well as filtering support for the Actor application info attribute for Gmail log events.

New Gemini adoption and usage metrics reports are now available in the Admin console.

Google has released new adoption and usage metrics for Gemini reports within the Admin console. These reports provide administrators with comprehensive visibility into AI feature usage, active users, and usage thresholds across various Workspace apps. This data helps administrators manage Workspace subscriptions, plan for potential upgrades, and make informed decisions regarding AI enablement and productivity within their organizations.

General availability of OneDrive to Google Drive file migration for Admins.

Google has announced the general availability of its data migration service allowing super admins to transfer files from Microsoft OneDrive to Google Drive. The tool supports migrating up to 100 users at once, preserves access permissions, and now includes advanced settings to filter by date range, exclude specific file formats or large files, and automatically map source and target users without requiring an identity map.

Introduction of the Access Evaluation log event to track security policy impacts on OAuth app access.

Google is introducing a new Access Evaluation log event in the Admin console to help administrators better understand how security policies, such as API controls, endpoint management configurations, and domain-wide delegation, affect user access to OAuth apps. The log provides detailed information on the specific policies applied, when access was granted, and the reasoning behind the decision, enabling admins to review and revise security policies to better protect Workspace data.

Admins can now use tokens as placeholders for user-specific information in managed iOS app configurations.

Google has introduced the ability for administrators to use tokens as placeholders for user or device-specific information, such as email addresses or device serial numbers, when configuring managed iOS applications via Google Mobile Device Management. This update allows admins to configure devices dynamically rather than using static configuration data.

Gemini usage reports are being added to the Admin console for Business and Enterprise customers.

Google is introducing Gemini usage reports in the Admin console to help administrators track AI adoption. These reports will be available for Business Starter, Standard, and Plus customers starting January 20, 2025, and for Enterprise Starter, Standard, and Plus customers starting January 29, 2025.

New admin settings to control user ability to add account recovery email and phone information.

Google is introducing two new settings in the Admin console that allow administrators to control whether users can add recovery email and phone information to their Google Workspace accounts. These settings can be configured at the organizational unit (OU) and group levels under Security > Account Recovery > Recovery information, helping organizations balance account security with local privacy regulations like GDPR.

Open beta for custom OpenID Connect (OIDC) profiles for Single-Sign On (SSO).

Google Workspace admins now have the option to set up custom OpenID Connect (OIDC) profiles for single sign-on (SSO) with Google as the Service Provider. This update expands authentication options beyond SAML and pre-configured Microsoft Entra ID profiles, allowing admins more flexibility in how end users access cloud applications using a single set of credentials.

Groups Editor and Groups Reader roles are now generally available for specific group types.

Google Workspace has announced the general availability of the Groups Editor and Groups Reader roles, which can now be provisioned for specific group types, such as security groups or non-security groups. These roles provide delegated admin permissions, allowing administrators to use conditions to limit access to sensitive groups as needed.

General availability of configuring third-party apps by select API scopes.

Google Workspace admins can now limit third-party app access to specific OAuth 2.0 scopes for Google APIs, such as Drive or Gmail. This provides more granular control and prevents apps from gaining additional access without admin consent, even if new scopes are requested in the future, ensuring data access is restricted to only what is necessary.

AI Classification now supports Field Selection for Model Training

AI Classification now allows customers to select a specific badge or option list field to train a model for after identifying a target label. Once the model is trained and enabled, it will automatically apply the label and populate only the selected field.

Context-Aware Access insights and recommendations are now generally available.

Google Workspace is introducing new insights and recommendations for Context-Aware Access (CAA) to help admins proactively identify security gaps and deploy pre-built access levels. These recommendations are initially placed in Monitor Mode, allowing admins to review potential access blocks via audit logs before full implementation. Admins can customize these recommendations, and primary admins will receive quarterly email updates containing actionable security insights to improve their organization's cybersecurity posture.

Streamlined Gemini app service settings in the Admin console.

Google is simplifying the Gemini app service settings in the Admin console by transitioning to a single checkbox for user access. Depending on whether this setting is checked, access will be granted to Gemini for Workspace licensed users, users with qualifying Workspace editions, or all users (including those accessing it as an additional service).