Google Workspace gives you strong security controls, but many depend on how your administrators configure them. Use this checklist to review the settings that matter most. Exact options vary by edition, so check what your licence includes.
1. Enforce 2-step verification
Make 2-step verification mandatory for all users, and use stronger methods such as security keys or passkeys for administrators where you can.
2. Limit and separate admin roles
Keep super admin accounts to a minimum, use dedicated admin accounts, and give other administrators only the roles they need.
3. Control third-party app access
Users can connect apps to their Google accounts. Review which apps have access to your data, restrict access to sensitive scopes and decide which apps are trusted.
4. Review Drive sharing settings
Check whether files can be shared outside your organisation, whether “anyone with the link” is allowed, and whether shared drives have sensible defaults.
5. Strengthen Gmail protections
Turn on the advanced phishing and malware protections available in your edition, including protection against suspicious attachments and spoofing.
6. Set up SPF, DKIM and DMARC
Authenticate your outgoing email so receiving servers can tell genuine messages from spoofed ones, and work towards an enforced DMARC policy.
7. Manage mobile devices
Decide which devices can access company data and apply basic mobile management, such as requiring a screen lock and allowing remote wipe of company data.
8. Monitor alerts and logs
Use the alert centre and audit logs to spot suspicious sign-ins, unusual sharing and changes to admin settings, and make sure someone reviews them.
9. Offboard leavers properly
Suspend accounts promptly when people leave, transfer their data, revoke app access and remove them from shared drives.
Get an independent view
Settings drift as teams grow and new apps are added. A Google Workspace configuration review checks your tenant against good practice and gives you a prioritised list of improvements. You can scope one online with the AskQ Scope Builder.
Quick wins for small IT teams
If time is short, start with the changes that block the most common attacks: enforce 2-step verification, review super admin accounts, restrict third-party app access and turn off automatic external forwarding where it isn’t needed. Each takes minutes to configure and makes a real difference.
Signs your tenant needs a review
- Nobody is quite sure who has admin rights
- Files are routinely shared using “anyone with the link”
- Former staff still appear in shared drives or groups
- Users can connect any third-party app without approval
- You’ve never checked your email authentication records
- Alerts arrive, but nobody owns them
If any of these sound familiar, an independent review will quickly show you where to focus.
Want help securing Google Workspace?
Talk to our team about a configuration review of your tenant.
