Google Workspace Changes

Automatic group membership management with dynamic groups, now generally available

Dynamic groups work the same as other Google Groups, but with the added benefit that their memberships are automatically kept up to date with a membership query.

New device management API now generally available

The new Devices API enables you to manage mobile and desktop devices within your organization.

Use Context-Aware Access (CAA) to create granular access control policies for pre-integrated SAML apps or custom SAML apps.

You can use Context-Aware Access (CAA) to create granular access control policies for pre-integrated SAML apps or custom SAML apps based on attributes including the user, location, device security status, and IP address.

New device management API available in beta

We’re launching a beta for a new API to manage company-owned and personal mobile devices and desktop devices.

Native support for NFC and USB security keys on iOS devices.

Google is enabling native support for the W3C WebAuthn implementation on Apple devices running iOS 13.3 and above. This allows users to use USB or NFC security keys directly on an iOS device for 2-Step Verification without the need to install the Google Smart Lock app.

Updated Admin console for 2-Step Verification and SSO for SAML controls

We’re updating the controls you use to configure 2SV in the Admin console.

Enhancing Context-Aware Access (CAA) with a beta that enables admins to use it to control SAML apps.

We’re enhancing Context-Aware Access (CAA) with a beta that enables admins to use it to control SAML apps. This gives admins the ability to control access to SAML apps based on the user, the device, and the context they are in when they are trying to access an app.

Context-Aware Access for SAML apps available in beta

Google is introducing a beta for Context-Aware Access (CAA) that allows administrators to control access to SAML apps based on the user, device, and context. This feature is available to G Suite Enterprise, G Suite Enterprise for Education, Cloud Identity Premium, and Drive Enterprise customers. Unlike CAA for G Suite applications, which offers continuous evaluation, CAA for SAML apps is enforced only at the time of sign-in.

Data regions allows G Suite customers to choose a specific geographic location for their covered data, with coverage of user indices for Gmail and Calendar, coverage of Google Keep primary data at rest and backups and more granular group-based controls

Data regions allows G Suite customers to choose a specific geographic location for their covered data. We’re enhancing data regions with three key updates: Coverage of user indices for Gmail and Calendar, Coverage of Google Keep primary data at rest and backups, More granular group-based controls.

Google now allows iPhones to be used as security keys for 2-Step Verification.

Google has added an option to use an iPhone as a security key for 2-Step Verification (2FA) to provide stronger protection against phishing and account takeover attacks. To enable this feature, users must install the Google Smart Lock app on a device running iOS 10.0 or higher. These security keys are compatible with Bluetooth-enabled Chrome OS (version 79+), iOS, macOS, or Windows 10 devices using a Chrome browser.

Set group membership deletion limits in Google Cloud Directory Sync (GCDS).

Google Cloud Directory Sync (GCDS) now allows administrators to set group membership deletion limits to prevent the accidental removal of memberships from groups. These limits, which can be set as a percentage (0-100%) or a specific number, ensure that if a sync attempts to delete more members than the defined threshold in any group, the sync will abort, preventing users from inadvertently losing access to Drive files and Google Cloud Platform resources.

Making it easy for admins to enable single sign-on for thousands of additional apps that don’t support modern authentication standards like SAML and OIDC.

This release provides seamless one-click access for users and a single point of management, visibility, and control for admins. With password vaulting, admins can: Manage credentials in a single space, Securely enable access to shared credentials, Manage access to app credentials based on group membership, and Log and access reports on usage of the credentials within their organization.

G Suite and Google Cloud Identity Premium now support password vaulted apps for single sign-on.

Google has introduced password vaulting for G Suite and Cloud Identity Premium, allowing administrators to enable single sign-on (SSO) for applications that do not support modern authentication standards like SAML or OIDC. This feature allows admins to centrally manage credentials, secure shared access based on group membership, and access usage reports, while providing end users with a new dashboard for one-click access to their apps.

Admins can now see and edit user recovery information

G Suite admins can now view and edit their users’ recovery information, such as backup email addresses and linked phone numbers. We also use this information to verify login requests and increase account security. By making sure your users have accurate and up-to-date information you can help make their accounts more secure.

Limiting access to less secure apps to protect G Suite accounts

Removing the setting to “Enforce access to less secure apps for all users” from the Google Admin console. We’re making this change to protect your users. LSAs connect to Google accounts using only a username and password, which makes them vulnerable to hijacking. Whenever possible, users should connect to their accounts via OAuth, a more secure method.