Google Workspace Security: The Complete Guide for IT Admins (2026)

Google Workspace runs the working day for millions of organizations — email, documents, shared drives, calendars, and the identities that tie them together. That concentration of data and access is exactly why it deserves a deliberate security strategy rather than the default settings you accepted on day one.

This guide walks through the areas that matter most, in the order an IT admin should think about them: identity, sharing, third-party access, administrative configuration, and ongoing monitoring. None of it requires a rip-and-replace project. Most of the highest-impact changes are settings you already own.

Start with identity, because everything else depends on it

Every file, every calendar, every mailbox in Google Workspace is reachable through an identity. If an attacker controls an account, the data that account can see is effectively theirs. That makes identity the foundation of Workspace security.

Three controls do most of the heavy lifting:

• Multi-factor authentication (MFA), enforced — not optional. A password alone is a single point of failure. Enforcing 2-Step Verification across the organization is the single most effective control you can deploy. We cover the rollout in detail in our guide to enforcing MFA across Google Workspace.
• Strong, phishing-resistant second factors where possible. Hardware security keys and passkeys resist the credential-phishing kits that defeat one-time codes. Reserve them at least for admins and other high-value accounts.
• Least-privilege admin roles. The super-admin role can do anything. Most of your administrators do not need it. Google Workspace supports custom administrator roles scoped to specific tasks; use them, and keep the number of super-admins as small as you can defend.

A useful exercise: list every account with administrative privileges and ask, for each one, "what is the worst thing this account could do if it were compromised tomorrow?" The answers usually reveal a few roles that are broader than they need to be.

Get control of Drive sharing

Drive is where the organization's knowledge lives, and sharing is where most data exposure begins. The problem is rarely malicious — it is convenience. Someone sets a document to "Anyone with the link" to unblock a meeting, the meeting ends, and the link lives on indefinitely, indexed and forwardable.

The patterns worth hunting down:

• Public links. Files shared to "anyone with the link" are reachable by anyone who obtains the URL. For sensitive content, that is an open door.
• External sharing. Files and folders shared with addresses outside your domain — partners, contractors, personal accounts — expand your data perimeter to systems you do not control.
• Domain-wide sharing. "Anyone in the organization" is appropriate for a handbook and dangerous for a folder of compensation data.
• Broken inheritance and over-ownership. A single over-shared parent folder can quietly expose everything beneath it.

Set sensible org-level defaults in the Admin console (restrict sharing outside the domain to a trusted list where your workflow allows it), but defaults only govern *new* shares. The shares created before you tightened the policy are still out there. Finding them is a discovery problem, which is where continuous scanning earns its keep. Our Google Drive sharing permissions checklist turns this into a concrete, repeatable review.

Audit the third-party apps connected to your tenant

Every "Sign in with Google" and every add-on a user installs grants an OAuth application some slice of access to your Workspace data — often Drive, sometimes Gmail, occasionally the ability to act on a user's behalf. Over months and years, that list grows into a sprawl of forgotten integrations, trial tools, and abandoned vendors, each one a standing grant of access that nobody is reviewing.

This is shadow IT in its most literal form: access you did not provision and may not even know exists. A risky OAuth grant does not need to phish anyone — the user already clicked "Allow."

What to look for:

• Apps with broad scopes (full Drive access, Gmail send, admin directory).
• Apps used by only one or two people but holding wide access.
• Apps from unverified publishers.
• Apps nobody has used in months.

We go deep on the mechanics — including how to read the scopes that matter — in how to audit third-party OAuth apps in Google Workspace.

Harden the admin configuration

Beyond identity and sharing, a set of organization-wide settings quietly determines your security posture. These are easy to set once and forget, which is precisely why they drift:

• Sharing settings: external sharing rules, link-sharing defaults, and whether users can publish files to the web.
• 2-Step Verification policy: enforced, with an enrollment deadline, and ideally allowing only strong factors for sensitive groups.
• Less secure app access and legacy protocols: disabled.
• Marketplace app installs: restricted to allow-listed or admin-approved apps, so users cannot grant access to arbitrary third parties.
• Mobile device management: basic policies so a lost phone does not become a data breach.
• Email authentication: SPF, DKIM, and DMARC configured to protect your domain from spoofing.

Treat these as a configuration baseline. Document the intended state, then check reality against it on a schedule — configuration has a way of drifting as exceptions get made and never get reverted.

Watch for risky behavior and AI agents

Static posture — who *can* access what — is half the picture. The other half is behavior over time: who is *actually* doing what, and whether it looks normal. A service account that has been dormant for six months and suddenly touches hundreds of files is worth a look, even if every individual permission is technically valid.

A newer wrinkle is non-human identities. AI assistants, automation platforms, and service accounts increasingly hold standing access to Workspace data and act on it autonomously. They rarely show up in a traditional user review, yet they can read, move, and share data at machine speed. Governing them — knowing which agents exist, what they can reach, and what they are doing — is becoming a core part of Workspace security. We cover the approach in how to detect risky AI agents in your Google Workspace.

Put it on a cadence

Security is not a project with an end date; it is a posture you maintain. A workable rhythm for most teams:

• Continuously: scan for new public links, external shares, and OAuth grants, and alert on the risky ones.
• Monthly: review the admin configuration baseline and the list of administrators.
• Quarterly: review external sharing relationships and the third-party app inventory; off-board anything stale.
• On every joiner/mover/leaver: adjust access promptly. Stale access from departed employees and role changes is one of the most common findings in any audit.

If you are accountable for the whole picture, our CISO's guide to Google Workspace risk assessment frames this as a repeatable assessment you can report on.

Where automation helps

You can do all of this manually. Admins have for years. But Workspace is large, sharing is constant, and the interesting findings are needles in a very large haystack. The realistic failure mode is not that teams do not *know* what to check — it is that they cannot keep up with the volume by hand, so reviews slip and exposure accumulates between them.

This is the gap continuous, automated posture management fills: it enumerates who and what can reach each resource, flags the exposures that matter, explains *why* each one is risky in plain language, and re-checks on every change so you are working from current reality instead of last quarter's spreadsheet. 8200.dev does exactly this for Google Workspace — read more about how it works or what we check.

The best time to put a baseline in place was the day you deployed Workspace. The second-best time is today.

Ready to see your own exposure? Start your free security audit and get a prioritized picture of public links, external sharing, OAuth apps, and admin misconfigurations across your Google Workspace — in minutes, read-only, no agent to deploy.