Google Workspace Changes

Existing reporting rules convert to activity rules for Business and Education Fundamentals customers, allowing notification frequency configuration and descriptive alerts.

For Google Workspace Business Starter, Business Standard, Business Plus, Education Fundamentals, Education Standard, and Enterprise Essentials customers, all existing reporting rules will automatically be converted to activity rules. Admins will now have the ability to configure notification frequencies and access more descriptive alerts. However, it's important to note that applying thresholds and actions to rules will not be available for these specific Workspace editions. This change aims to provide a more streamlined workflow for managing alerts.

Reporting rules are combined with activity rules for Enterprise and Education Plus customers, adding threshold-less rules and a new event-based threshold mode.

For Google Workspace Enterprise Plus, Enterprise Essentials Plus, Education Plus, Cloud Identity Premium, Chrome Enterprise Premium, and Enterprise Standard customers, reporting rules are now combined with activity rules. This change allows admins to create rules without thresholds and introduces a new threshold mode that triggers a rule every time a relevant event occurs. This aims to simplify the admin experience for creating rules and monitoring alerts within the Admin console.

Google Workspace is implementing a Shared Signals Framework (SSF) Receiver to enhance security by ingesting Continuous Access Evaluation Profile (CAEP) signals, currently in closed beta.

The Shared Signals Framework (SSF) is an initiative by the OpenID Foundation to standardize cross-system communication between security platforms, facilitating the sharing of security insights and events. Google Workspace is supporting this initiative by implementing an SSF Receiver to ingest Continuous Access Evaluation Profile (CAEP) signals. This feature is currently available in a closed beta for Google Workspace customers and interested partners. An example use case for this enhancement is session revocation, where a signal to revoke a session will automatically invalidate the user's session, thereby reducing the window of access for potentially compromised users. This improves security by enhancing cross-system communication and accelerating responses to security incidents.