Google Workspace Security Audit: 25 Settings to Check Today (With Admin Console Paths)
Most Google Workspace tenants at small businesses were set up in an afternoon, years ago, by whoever was handy. The defaults are reasonable, but "reasonable" leaves gaps: one super admin with SMS codes, mail forwarding open to anyone, Drive links shared with "anyone on the internet", and OAuth apps nobody remembers approving. This is a read-first audit. Work through the 25 settings below, write…
1. Google Workspace tenants at small businesses are often set up by whoever is available, with default settings that leave vulnerabilities. These include a single super admin with SMS codes, mail forwarding accessible to anyone, shared Drive links with unrestricted internet access, and unapproved OAuth applications.
2. The audit begins by reviewing the number of super admins. It is recommended to have two to four named individuals in this role, rather than one or ten.
3. Super admin accounts should be separate from daily email, browsing, and chat accounts to prevent phishing risks. Self-recovery options should be carefully managed, preferably off unless each super admin has unique recovery contact information.
4. Two-step verification is permitted and enforced by default. It is recommended to enable 2-Step Verification for all users and enforce it at the outset, setting a short enrollment period.
5. Phishing-resistant 2SV for administrators should be limited to security keys, with passkeys as a backup option. This helps prevent unauthorized access to administrator accounts.
6. Passkeys, which are phishing-resistant and more user-friendly, should be allowed for users in a pilot OU.
7. A strong password policy is advised, requiring at least 12 characters, enforced at the next sign-in, and not allowing password reuse.
8. Session length for web access should be defined, typically between 12 to 24 hours for regular users and shorter for administrators, to limit the impact of stolen session cookies.
9. Email security settings include enabling SPF, DKIM, and DMARC for every sending domain. DKIM should be set to generate and authenticate records using 2048-bit encryption, while SPF should have one unique record per domain and DMARC should progress from p=none with reporting to stricter enforcement levels once legitimate senders are identified.
10. Enhanced pre-delivery message scanning is recommended, which provides an additional layer of protection by scanning emails before they reach the inbox.
11. Gmail attachment protections should be enabled, protecting against encrypted attachments, scripts, and unusual attachment types. Automatic application of recommended settings should be allowed for future updates.
12. Link and external image protections should be activated, which include checking shortened URLs, scanning linked images, and warning users before clicking on untrusted domains, all with automatic application of recommended settings.
13. Spoofing and authentication protections should be enabled for five different scenarios, including similar domain names, employee name spoofing, mail spoofing the domain, unauthenticated mail, and protection for Groups.
14. Automatic email forwarding should be disabled for most organizations to prevent attackers from silently copying mailboxes. Forwarding should only be allowed in specific OUs with documented needs.
15. POP and IMAP access should be disabled unless an OU has a documented requirement for legacy clients, as older mail clients can bypass modern sign-in protections.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
