Google Workspace Changes

Use groups to manage Context Aware Access for G Suite

Administrators can now use groups to manage context-aware access for their organization, offering more flexibility than the previous method of managing access solely by organizational unit (OU). This allows for more granular access controls based on user identity and context—such as location, device security status, and IP address—making it easier to apply specific policies to executives, admins, or temporary workers.

Changing default scope for Service Settings delegated admins

Changing the default scope for delegated admins with the “Service Settings” privilege. As a result, some admins may need to be re-granted access to the security center.

Changing default scope for Service Settings delegated admins

Google is changing the default scope for delegated admins with the 'Service Settings' privilege. Previously, assigning the 'Service Settings' privilege automatically included the 'Security Center' privilege by default. Now, the 'Security Center' privilege must be granted specifically. Consequently, some delegated admins may lose access to the security center and will need to be re-granted permission by a Super Admin via the Admin console.

Manage Windows 10 devices through the G Suite Admin console

Enabling enhanced desktop security for Windows with a new beta. This will allow you to manage and secure Windows 10 devices through the Admin console, just as you do for Android, iOS, Chrome, and Jamboard devices today. It will also enable SSO so users can more easily access G Suite and other SSO-enabled applications on Windows 10 devices.

Manage and secure Windows 10 devices through the G Suite Admin console via a new beta.

Google is launching a beta that enables G Suite admins to manage and secure Windows 10 devices directly from the Admin console, similar to Android, iOS, and Chrome devices. This update introduces Single Sign-On (SSO) for easier access to G Suite and other enabled applications, enhanced security features like anti-phishing and suspicious login detection, and the ability to push cloud-based configuration updates (such as BitLocker and Windows Update) or remotely wipe devices to ensure compliance and data security.

Enable SAML apps for specific groups of users.

Administrators can now enable SAML applications for specific groups of users within their organization, providing more flexibility than the previous method of enabling them only by organizational unit (OU). This allows apps to be turned on or off for specific sets of users without altering the organizational structure.

Password recovery for super admins and a new interface for security settings

Making it easier for super admins to recover their own passwords, as well as updating the look of some basic security settings in the Admin console.

Security settings in the Admin console are migrating to a streamlined, card-based interface.

Google is gradually migrating security settings within the Admin console to a more streamlined, card-based interface. These visual updates are intended to improve the user experience and generally will not impact the actual configuration of settings or existing workflows.

Super admins can now recover their own passwords using the 'Forgot password?' link.

Google is introducing a 'Super admin account recovery' setting in the Admin console. When enabled, super admins who have added recovery options to their accounts can recover their own passwords via the 'Forgot password?' link on the sign-in page, removing the need to contact another super admin or Google Support.

Support ticket numbers in Access Transparency audit logs

G Suite admins can now see support ticket numbers associated with requests directly within the Access Transparency audit log report, allowing for easier tracking of Google staff actions related to customer data.

Email alerts for Access Transparency logs

G Suite admins can now create automated email alerts to be notified when specific criteria related to Access Transparency logs are met, such as using the 'Event Name = Access' filter, providing better visibility into actions taken by Google staff.

Improved search results in the G Suite Admin console.

Google is updating the search results in the G Suite Admin console to be more helpful. Key improvements include a new results page box with links to the Help Center and FAQs, enhanced readability through updated fonts and spacing, and the continued use of tabs to quickly refine search results by categories such as users, groups, settings, and devices.

New option to restrict security codes to the same device or network they were generated on.

Google is introducing a new security setting for security codes, allowing admins to restrict their use to the same device or local network (NAT or LAN) where they were generated. This reduces potential vulnerabilities while still supporting legacy authentication. Admins can now choose from three options: disabling security codes entirely, allowing them without remote access, or allowing them with remote access for use on other devices or networks.

Advanced Protection Program for the enterprise is now generally available to protect high-risk users.

The Advanced Protection Program for the enterprise is now generally available, offering a bundle of high-security policies for employees most at risk of targeted attacks, such as IT admins and executives. The program enforces the use of security keys, blocks most untrusted third-party apps from accessing Drive and Gmail data, and provides enhanced email scanning. Additionally, a new default option 'allow security codes without remote access' has been introduced, restricting security code usage to the same device or local network.

New filter added to the device list to identify devices without endpoint verification.

Google is introducing a new filter in the Admin console device list that allows admins to identify devices accessing corporate data without endpoint verification. This enhancement helps admins better manage the deployment of Endpoint Verification and Context-Aware Access by identifying potential user disruptions before the controls are turned on.