Google Workspace Changes

Improvements to local administrative access controls on Windows devices

Google is updating the administrative privileges setting for Windows device management to provide administrators with more control over local administrative access on Windows 10 and Windows 11 devices managed by Google Endpoint Management. This update simplifies settings and offers greater flexibility for organizations needing to maintain local admin access while managing specific users through Google Workspace. Previously, managing local administrative access used a 'Replace' behavior, which removed any existing members from the local administrators group before adding new ones.

More granular controls for multi-party approvals for sensitive admin actions.

Google is introducing more granular controls for multi-party approvals (MPA) for sensitive admin actions. This enhancement allows admins to select which specific settings require MPA, choose separate MPA settings for actions supported via API and the admin console, and delegate specific admins to approve MPA actions using a new multi-party approval role. This feature adds an extra layer of security by ensuring sensitive actions are not implemented in a silo and helps prevent unauthorized or accidental changes.

Consent re-confirmation for under 18 users accessing Additional Services will soon be required

Admins who have Additional Services enabled for users under the age of 18 to re-review them on an annual basis. Admins are always in control of which services their users have access to, and this gives admins an opportunity to ensure the right users have access to the right services.

Admins now have the option to set up a custom OpenID Connect (OIDC) profile for single sign-on (SSO) with Google as their Service Provider.

This update gives admins more options for their end users to access cloud applications using a single set of credentials. Previously, only OIDC with pre-configured Microsoft Entra ID profile was supported in addition to SAML.

GCDS will now comply with the conflicting accounts management settings specified in the Admin console.

When Google Cloud Directory Sync (GCDS) attempts to create new users, it may encounter unmanaged accounts that conflict with the accounts it’s attempting to create. In these instances, GCDS will now comply with the conflicting accounts management settings specified in the Admin console.

Google Workspace Admins can now use Directory Sync to sync users and groups from Azure Active Directory.

Google Workspace Admins can now use Directory Sync to sync users and groups from Azure Active Directory. Directory Sync is an alternative to Google Cloud Directory Sync (GCDS), which admins can use to synchronize user and group data with their Google Cloud directory without the need to manage on-prem hardware and deployments.

Admins can now use Directory Sync to sync users and groups from Azure Active Directory, as an alternative to Google Cloud Directory Sync (GCDS).

Google Workspace Admins can now use Directory Sync to sync users and groups from Azure Active Directory. Directory Sync is an alternative to Google Cloud Directory Sync (GCDS), which admins can use to synchronize user and group data with their Google Cloud directory without the need to manage on-prem hardware and deployments. Directory Sync is available in open beta, which means no beta sign-up or registration is required. Admins can add up-to one Azure Directory connection to sync users and groups information to the Google Cloud Directory. On your Microsoft Azure Active Directory side, Global Administrator privileges are required for using this feature. You can delegate the ability to manage Active Directory with the new Directory Sync admin user role.

New Alert Center notifications for Apple push certificates.

To help you stay on top of their renewal period and take action in a timely manner, we will: Notify you via the Alert Center and email when: Your certificate is 30, 10, and 1 day from the date of expiration. Your certificate has expired.

Migrate unmanaged accounts to your domain using new “UserInvitation” API functionality

We’re introducing new API functionality which allows you to automate the process of finding conflicting accounts and inviting them to join your organization.

Launching a beta for a new Directory Sync solution which can make it quicker and easier to synchronize your Active Directory user and group data with your Google Cloud directory.

We’re launching a beta for a new Directory Sync solution which can make it quicker and easier to synchronize your Active Directory user and group data with your Google Cloud directory. Directory Sync is an alternative to Google Cloud Directory Sync (GCDS).

New enterprise certificate condition for context-aware access rules to identify company-managed devices.

Administrators can now use enterprise certificates as a signal to determine if a device is company-owned when configuring context-aware access rules. This allows for the creation of more specific and secure policies based on the trustworthiness of the device, ensuring that only company-managed assets can access certain resources.

Set user language programmatically with the Directory API

Use Google Workspace Admin SDK Directory API to customize a per user language preference via the user create/update flow.

Set user language programmatically with the Directory API

With this launch, you can use Google Workspace Admin SDK Directory API to customize a per user language preference via the user create/update flow.

Control session length for Google Cloud Console and gcloud CLI now generally available

Giving admins more control over how often users need to re-authenticate makes it more difficult for the wrong people to obtain that data if they gain unauthorized access to a device.

Automate unmanaged account onboarding with the User Invitation API beta

We’re adding a User Invitation API to the Cloud Identity API. This new API allows you to identify and manage unmanaged accounts.