Most Google Workspace tenants at small businesses were set up in an afternoon, years ago, by whoever was handy. The defaults are reasonable, but "reasonable" leaves gaps: one super admin with SMS codes, mail forwarding open to anyone, Drive links shared with "anyone on the internet", and OAuth apps nobody remembers approving.
This is a read-first audit. Work through the 25 settings below, write down what you find, and only then decide what to change. Every path starts from the Google Admin console (admin.google.com) and was checked against Google's current admin help pages in October 2026. Google moves menus around, so if a path doesn't match, search the setting name in the console's search bar.
Before you start
- Use a super admin account, but not your daily one if you can avoid it. Some settings below are visible only to super admins.
- Record, don't fix. Make a simple sheet with four columns: Setting, Current value, Recommended, Action. Changes go through a test organizational unit (OU) first.
- Know your OUs. Most settings can be applied per OU or per group. A setting can look right at the top level and be overridden for one department. Check the left-hand OU panel on each page.
- Check your edition. A few items depend on edition. Where that matters, it's noted.
Admin accounts and sign-in (1 to 8)
1. How many super admins you have
Path: Account > Admin roles > Super Admin, then view the assigned admins.
Target: two to four named people. One is a single point of failure; ten means ten accounts that can take over the tenant. Use narrower prebuilt or custom roles for help desk work.
Settings only stay secure if the right people hold admin rights, so repeat this check every quarter with a user access review template.
2. Super admins have separate admin-only accounts
Path: Directory > Users, open each super admin, then Admin roles and privileges.
Target: the super admin identity is not the same account used for daily email, browsing and chat. Daily accounts are the most phished.
3. Super admin self-recovery
Path: Security > Authentication > Account recovery > Super admin account recovery.
Target: a deliberate decision. Google recommends turning self-recovery off if you have several super admins who can help each other. If you leave it on, make sure each super admin's recovery phone and email belong to them and are current.
4. 2-Step Verification is allowed and enforced
Path: Security > Authentication > 2-step verification.
Target: "Allow users to turn on 2-Step Verification" checked, and Enforcement set to On (or "Turn on enforcement from date") for every OU. Set a short new-user enrollment period, such as one to two weeks. Google is also enforcing 2SV for administrator accounts.
5. Phishing-resistant 2SV for admins
Path: same page, select the OU or group that holds your admins, then Methods.
Target: "Only security key". Google's help notes that this option now accepts passkeys as well as hardware keys. Check who has keys enrolled first (Reporting > User Reports > Security) so you don't lock anyone out, and generate backup codes for emergencies.
6. Passkeys allowed
Path: Security > Authentication > Passwordless > Skip passwords.
Target: "Allow users to skip their password and authenticate with a passkey" checked, at least for a test OU. Passkeys are phishing-resistant and usually easier for staff than codes.
7. Password policy
Path: Security > Authentication > Password management.
Target: enforce strong passwords, a minimum length of at least 12 characters, "Enforce password policy at next sign-in" checked, and password reuse not allowed. Avoid forced periodic expiry, which tends to produce weaker passwords.
8. Web session length
Path: Security > Access and data control > Google session control.
Target: a defined session duration rather than "never expires", for example 12 to 24 hours for most users and shorter for admins. Shorter sessions limit the value of a stolen session cookie.
Email (9 to 16)
9. SPF, DKIM and DMARC
Path for DKIM: Apps > Google Workspace > Gmail > Authenticate email. SPF and DMARC live at your DNS host.
Target: DKIM generated and authenticating for every sending domain (2048-bit where your DNS host allows it). One valid SPF record per domain. A DMARC record that moves from p=none with reporting to p=quarantine or p=reject once legitimate senders are aligned.
10. Enhanced pre-delivery message scanning
Path: Apps > Google Workspace > Gmail > Spam, Phishing and Malware.
Target: enhanced pre-delivery scanning turned on. It lets Gmail take a little longer to catch phishing before it reaches the inbox.
11. Attachment protections
Path: Apps > Google Workspace > Gmail > Safety, then Attachments.
Target: protection against encrypted attachments, attachments with scripts and anomalous attachment types turned on, with an action stronger than the default warning (spam or quarantine). Check "Apply future recommended settings automatically".
12. Link and external image protections
Path: Apps > Google Workspace > Gmail > Safety, then Links and external images.
Target: identify links behind shortened URLs, scan linked images, warn on clicks to untrusted domains, and apply future recommended settings automatically.
13. Spoofing and authentication protections
Path: Apps > Google Workspace > Gmail > Safety, then Spoofing and authentication.
Target: all five protections on (similar domain names, employee name spoofing, inbound mail spoofing your domain, unauthenticated mail, and Groups protection). These directly reduce invoice and CEO-fraud email.
14. Automatic forwarding
Path: Apps > Google Workspace > Gmail > End User Access, then Automatic forwarding.
Target: "Allow users to automatically forward incoming email to another address" unchecked for most OUs. Attackers set up forwarding to quietly copy a mailbox after a takeover. Allow it only for OUs with a documented need.
15. POP and IMAP access
Path: Apps > Google Workspace > Gmail > End User Access, then POP and IMAP access.
Target: off, unless an OU has a documented client that needs it. Older mail clients are a common way around modern sign-in protections.
16. External recipient warning
Path: Apps > Google Workspace > Gmail > End User Access, then the external recipient warning setting.
Target: on. It catches misaddressed email and replies to look-alike domains.
Sharing and collaboration (17 to 19)
17. Drive external sharing
Path: Apps > Google Workspace > Drive and Docs > Sharing settings > Sharing options.
Target: external sharing either off or limited to allowlisted domains for sensitive OUs. Where it stays on, warn users when sharing outside the organization and don't let files be published to the web without review. Then review what's already shared publicly. Settings stop new exposure but don't fix the old.
18. Calendar external sharing
Path: Apps > Google Workspace > Calendar > Sharing settings.
Target: external sharing of primary calendars set to "Only free/busy information". Full details leak meeting titles, dial-ins and who reports to whom.
19. Groups for Business sharing
Path: Apps > Google Workspace > Groups for Business > Sharing settings.
Target: external access to groups restricted by default, and group owners not able to let people outside the organization join. Then check that no group lets "anyone on the web" view or post.
Apps, API access and AI (20 to 23)
20. Third-party app access (OAuth)
Path: Security > Access and data control > API controls, then Manage App Access and Settings.
Target: review every app with access to Gmail, Drive or admin data, and mark each one Trusted, Limited or Blocked on purpose. Under Settings, decide what users can do with unconfigured third-party apps. Restricting access to high-risk Google data such as Gmail and Drive is a strong default.
21. Domain-wide delegation
Path: Security > Access and data control > API controls > Manage Domain Wide Delegation.
Target: every client ID has a known owner, a current purpose and the minimum scopes. Delete anything nobody can explain. Domain-wide delegation lets a service act as any user, so treat it as a crown-jewel credential.
22. Marketplace app installs
Path: Apps > Google Workspace Marketplace apps > Apps list > User Install Settings.
Target: "Allow users to install and run only selected apps" (allowlisted apps), with a simple request process for new ones.
23. Gemini and AI access
Path: Generative AI > Gemini app.
Target: access turned on only for the OUs or groups your AI acceptable use policy covers. Make sure staff know which AI tools are approved and what data they may use with them. Tidy your Drive sharing (item 17) first, because AI assistants can surface whatever a user already has access to.
Devices, data and monitoring (24 and 25)
24. Mobile device management
Path: Devices > Mobile & endpoints > Settings > Universal > General > Mobile management.
Target: at least Basic management, with a screen lock required, so you can sign a lost phone out of company data. Use Advanced where your edition supports it and you need device approval or full wipe.
25. Takeout and alerting
Paths: Data > Data import & export > Google Takeout and Security > Alert center.
Target: Google Takeout turned off for departing-user and sensitive OUs, so a leaver can't bulk-download their mailbox and Drive. In the Alert center, make sure alerts such as suspicious login, leaked password, government-backed attack and super admin changes reach a mailbox someone actually reads. An alert nobody sees isn't an alert.
Scoring your audit
Give each item a status: OK, Gap, or Accepted risk (with a reason and an owner). Then sort the gaps:
- This week: 1, 4, 5, 9, 13, 14, 20. These close the most common account takeover and business email compromise paths.
- This month: 2, 3, 7, 11, 12, 15, 17, 21, 25.
- This quarter: everything else, plus a review of existing public Drive shares.
Making changes safely
- Test first. Create a "Test-Security" OU with IT and one or two willing staff. Apply the change there and wait a few days.
- Communicate before enforcing. Tell people what's changing, when, and what they need to do (for example, enroll a passkey before the 2SV date).
- Have a way back in. Keep at least one tested super admin with a hardware key stored securely before you tighten admin 2SV.
- Write it down. Log the date, the setting, the old value and the new value. When something breaks next month, the change log is the first place you'll look.
- Re-audit quarterly. Google adds new settings, staff change and exceptions creep back in.
Resources: Free M365 + Google Workspace hardening checklist · Full 82-control version with a scored workbook and read-only GAM scripts: Google Workspace Security Audit Checklist ($39; code LAUNCH30 takes 30% off paid kits through Oct 31, 2026). I make these templates.
Drafted with AI assistance and reviewed for accuracy.
Not affiliated with Microsoft or Google.
