Google Workspace Security: A Practical Guide for Administrators (2026)
What each edition allows, the ten configuration practices ranked by impact, and what the GDPR requires of a Spanish company. Includes the exact console path for each setting.
Google Workspace comes well-protected out of the box, but it is not pre-configured.
The difference between a secure tenant and an exposed one almost always lies in a dozen admin console settings that no one reviewed after the migration.
This guide walks through those settings in order of impact, with the exact path to each one and—this is what is usually missing— the minimum edition required to have it. Because half of the security tips circulating about Google Workspace describe features that your license doesn't include.
Start here: what your edition allows
Before planning anything, it pays to know what cards you’re holding. Not all security features are included in every edition, and discovering this halfway through a hardening project is the quickest way to waste time. Google maintains the edition-specific details in its Administrator Help Center.
| Function | Editions that include it |
|---|---|
| Two-step verification and passkeys | All |
| External sharing control in Drive | All |
| Gmail anti-phishing and anti-spoofing protections | All |
| SPF, DKIM, and DMARC | All (they are configured in your DNS ) |
| Third-party application access control ( OAuth ) | All |
| Basic device management | All |
| DLP reports (read-only, no rules) | Includes the Business editions |
| DLP / Data Protection Rules | Frontline Standard and Plus; Enterprise Standard and Plus; Education Fundamentals, Standard and Plus; Enterprise Essentials Plus |
| Security Center: dashboard, investigation tool, and security status | Frontline Standard and Plus; Enterprise Standard and Plus; Education Standard and Plus; Enterprise Essentials Plus |
| View sensitive content in the investigation tool | Frontline Plus; Enterprise Plus; Education Standard and Plus |
Two conclusions that should be clear from the start:
If you are on any Business edition, you do not have DLP rules or Security Center. You have DLP reports, which tell you what sensitive content exists but do not take action on it, and you have the Audit and investigation page instead of the full investigation tool. You can do a lot with that, and the ten practices below indicate which ones apply to you.
Being on a supported edition does not mean having full functionality. Enterprise Standard, for example, provides access to the investigation tool but only to a subset of data sources, and it cannot view the sensitive content of a message. If your use case involves in-depth incident investigation, the edition you need is Enterprise Plus.
The real risks and what mitigates them
| Risk | Mitigation in Google Workspace |
|---|---|
| Phishing and sender impersonation | Advanced Gmail protections plus properly configured SPF, DKIM, and DMARC |
| Credential theft | Two-step verification with passkeys or physical keys, and contextual access |
| Compromise of an administrator account | Fewer super admins, security keys, and Advanced Protection Program |
| Data leakage due to sharing | External sharing controls in Drive and DLP rules where editing allows it |
| Malware and ransomware | Automatic scanning of Gmail attachments and Drive files |
| Third-party applications with excessive access | Application access control and periodic review of OAuth permissions |
| Lost or unmanaged devices | Device policies with encryption, locking, and remote wipe |
The 10 practices, in order of impact
1Mandatory two-step verification, leaving no one behind.
Two-step authentication remains the measure offering the best balance between effort and protection. Two nuances that make the difference:
Prioritize passkeys and physical security keys. They are resistant to phishing, which is precisely the most common attack vector used against Workspace. Code-generating apps are acceptable as a backup. It is advisable to disable SMS as a method: it is the weakest option, and its presence lowers the overall security level.
And don't activate it as mandatory all at once. Define an enrollment period for registration, create a temporary exception group for cases requiring more time, and determine the recovery procedure in advance. Enforcing the requirement without these measures leaves users locked out on the first Monday.
2Fewer super-administrators, and an emergency account
Super admin accounts are a prime target for attackers, and most organizations have more of them than necessary. Reduce the number to a minimum, assign delegated roles with specific permissions for day-to-day tasks, and enroll the remaining super admins in Google's Advanced Protection Program or require them to use physical security keys.
The point that hardly anyone considers: Maintain an emergency super administrator account., with their recovery codes stored outside the system in a physically secure location. Hardening security without this safety net exposes you to losing access to your own tenant—an incident just as serious as an intrusion, and significantly more common.
3Strict sharing policies in Drive
Limit external sharing to the most restrictive level your operations allow. If you need to work with specific clients or suppliers, use a trusted domain list rather than opening up sharing to the entire internet. Also, review access expiration settings and whether users can create public links.
It is best to be realistic here: An overly restrictive policy with no practical alternative leads people to use their personal accounts.. Design the policy together with the workflow it is intended to replace.
4Advanced anti-phishing protections in Gmail
Enable protection against sender impersonation for your own domain, detection of lookalike domains, analysis of suspicious links and attachments, and visible warnings for external recipients. These are settings that aren't all enabled by default and take just minutes to set up.
5SPF, DKIM, and DMARC
| Protocol | Function |
|---|---|
| SPF | Declare which servers are authorized to send email on behalf of your domain. |
| DKIM | Digitally sign your messages so the recipient can verify that they have not been altered. |
| DMARC | It tells the recipient what to do with email that fails SPF or DKIM, and sends you reports. |
This is no longer an optional best practice. Since 2024, major email providers have required authentication for high-volume senders., so without DMARC configured, your legitimate communications start ending up in spam. Start with a monitoring policy, review the reports for a few weeks to avoid blocking your own email, and progressively tighten it.
6Audit third-party applications with OAuth access
Every application a user has authorized has an open door to the organization's data. Review what is connected, revoke unused applications, and shift to an allowlist model instead of letting any user authorize anything.
Pay special attention to applications with broad permissions for Gmail or Drive, and to those... service accounts with domain delegation: these can act on behalf of any user in the domain. If your organization is building its own integrations, the identity model is decided before writing code—we cover this in the guide on integrate Google Workspace with your systems.
7Contextual access
It is the most underrated feature in the catalog. Instead of basing access solely on credentials, you make it conditional on context—such as the network the user is connecting from, whether the device is managed and encrypted, or the country of origin. For instance, you can require a corporate device to access Drive while allowing email access from anywhere.
It is what turns a static security configuration into one that responds to the actual risk of each access.
8Device management
It requires encryption, screen locking, and the ability to remotely wipe the corporate profile. On personal devices, it uses work-profile-only management: it protects company data without affecting the employee's personal data, which also reduces resistance to implementing it.
9Data protection rules (DLP)
DLP rules detect sensitive content—card numbers, tax identifiers, or custom patterns you define—and take action: they notify the user, block sharing, or generate an alert.
Always start in audit-only mode. Let the rules run in monitoring mode for a few weeks, review the false positives, and only then switch to blocking. A poorly calibrated DLP rule that blocks legitimate work gets disabled within a week and never comes back.
If you are on a Business edition, what you have are the DLP reports: they tell you what sensitive content exists in Drive and outbound email, without the ability to take automatic action. They are a good starting point for internally justifying the move to the next edition, because they quantify the risk.
10Visibility: Security Center or Audit and investigation
The Security Center brings together three elements: a dashboard providing a snapshot of your security posture, a security status page that compares your configuration against Google's recommendations, and an investigation tool for analyzing incidents and taking bulk actions—such as deleting a malicious email from all mailboxes simultaneously.
Remember the nuance of the matrix: Accessing the tool does not mean having full functionality.. Viewing the sensitive content of a message during an investigation requires Enterprise Plus, Frontline Plus, or Education Standard or Plus.
If your edition doesn't include Security Center, the Audit and investigation page provides the logs for retrospective analysis. It’s less convenient, but the information is there.
Compliance: what operating in Spain requires
Hardening the configuration is one part of the job. The other is to be able to prove it, and for a Spanish company, that means GDPR.
Data regions
Higher-tier editions allow you to specify that your organization's data at rest be stored in Europe. This does not replace a legal analysis, but it is a common element in impact assessments and vendor questionnaires.
Retention and eDiscovery
Vault allows you to define retention policies and preserve information in response to legal requirements. It makes the difference between being able to respond to a claim and not being able to. It is available starting with Business Plus edition, though it is worth checking the specific details for your edition.
Client-side encryption
For highly regulated sectors, it allows encryption keys to remain under your control rather than Google's. This is an architectural decision, not a simple toggle switch: it affects capabilities such as searching within encrypted documents.
Audit logs
Workspace logs are proof that your controls are working. Configure them with a sufficient retention period and export them if you need to keep them longer than the console allows.
If you are approaching this work as part of a broader infrastructure project, the starting point is the assessment: where the data resides and what level of compliance you require. We cover this in the Google Cloud in Spain Guide 2026.
Workspace security is not a silo.
Google Workspace should not be secured in isolation from the rest of your Google Cloud environment.
Centralized identity
Cloud Identity unifies single sign-on and access policies across Workspace and the rest of your Google Cloud services, ensuring that a policy change applies everywhere and an employee offboarding revokes all access at once.
Consistent data policies
Classification and retention should be applied using the same criteria across Workspace and your Google Cloud workloads. Having two different models creates gaps right at the seams.
Unified monitoring
Exporting Workspace audit logs to Google SecOps allows you to correlate activity in email and Drive with activity in your infrastructure. An intrusion attempt rarely remains confined to a single layer.
That same single-platform principle applies when you incorporate AI into your Workspace data: the governance must be the same. We elaborate on this in the article about Gemini Enterprise for Spanish companies.
Security is a process, not a project.
The ten preceding practices constitute an initial setup. What maintains the level is the routine.
Periodic audits. Schedule a quarterly review of active users, administrator roles, connected applications, sharing policies, and device status. The console's security status page provides a starting point based on Google's recommendations.
The human factor. Even the strictest configuration cannot withstand a user entering their credentials on a fake webpage. A continuous training program featuring phishing simulations, clear criteria for identifying malicious email, and an easy way to report suspicious activity yields better results than any additional console adjustment.
Adoption is part of security: a policy that people do not understand ends up being bypassed. If you have recently undergone a migration, it is advisable to review it alongside the adoption and change management plan.
How we approach it at The Cloud Collective
As Google Cloud Premier Partner in Barcelona, we begin every security review in the same place: which edition you have and what it actually allows you to do. From there, we audit the current configuration and prioritize the gaps. based on real impact rather than checklist length, and we design data sharing and protection policies based on the sector and the specific obligations of each client.
When the current edition falls short of the level of control the business needs, we state this clearly—referencing the feature matrix and the associated costs—rather than recommending functions not included in the license. We also document the configuration so your team can audit it without relying on us.
Frequently Asked Questions
It is built on a very robust infrastructure and includes active protections from day one. However, several of the most effective measures are not enabled by default: mandatory two-step verification, external sharing restrictions, and control over third-party applications. Ultimately, security depends on configuration, and that is the organization's responsibility.
No Business edition includes DLP rules or Security Center. You need Enterprise Standard or higher, Frontline Standard or higher, Enterprise Essentials Plus, or the corresponding Education editions. The matrix at the beginning of the article provides the details, including functionality differences within each tier.
Quite a lot: mandatory 2-step verification with passkeys, super-admin governance, external sharing restrictions in Drive, all Gmail anti-phishing protections, SPF, DKIM, and DMARC, OAuth app control, and device management. That covers the most common attack vectors. What you won't have is the ability to automatically block the exfiltration of sensitive data or centralized incident investigation.
Compliance depends on your processes, not just the license, but certain tools that facilitate it are limited by edition: data regions, advanced retention, and client-side encryption. GDPR compliance is possible with Business editions; it simply involves more manual work and less capacity for automated demonstration.
A quarterly review is a good cadence for a stable organization. Additionally, it is advisable to conduct a review following any significant change—such as mass onboarding, the connection of a new application, an edition change, or an incident.
Using the Admin SDK Reports API , or via export to BigQuery for editions that support it. From there, they can be sent to Google SecOps or the monitoring system you use.
Conclusion
Google Workspace security is not resolved with a list of twenty settings, but rather by knowing... which of them are available in your edition, which ones address the risks that truly affect you, and in what order to apply them without blocking anyone's work.
If you had to choose three things to keep:
Phishing-resistant two-step verification for everyone.
Real control over who information is shared with outside the organization.
Sufficient visibility to know what happened when something happens.
Do you want to know what your current configuration is?
At The Cloud Collective we can audit it, compare it against your edition's capabilities, and provide a plan prioritized by impact—without recommending features not included in your license.
Request a security audit
