Google Workspace Hardening Guide

Having recently configured a new Google Workspace environment, I am sharing my insights on how to best secure it in 2026.

Lock Down Admins First

  • Fewer super admins. Target 2–3 named super admins + 1 break-glass. Everyone else gets a custom role with only what they need. (Admin console → Account → Admin roles)

  • Hardware keys for admins. Enforce Yubikey-only MFA for the admin group. Passkeys are OK if they're hardware-bound.

  • Separate admin accounts. Daily-driver account ≠ admin account. No email/browsing on the admin one.

Identity And Sign-In

  • SSO and SCIM setup through your IDP for everyone. Keeps authentication and offboarding in one place.

  • MFA enforced at the Google layer too, as a backstop if SSO is ever bypassed (e.g., direct Google login for super admins).

  • Session length. Set Google session control to something sane (e.g., 12–16h web) so stolen cookies age out.

  • Login challenges + suspicious-login alerts on. Default, but confirm nobody turned them off.

Third-Party Apps And OAuth

  • Block unconfigured third-party apps from accessing Workspace data. (Security → Access and data control → API controls)

  • Restrict high-risk scopes (Gmail, Drive full access) to approved apps only.

  • Audit existing grants quarterly -users have probably already granted stuff years ago.

  • Domain-wide delegation: review every service account with DWD.

Gmail

  • SPF, DKIM, DMARC at p=reject for every sending domain, including parked domains (v=spf1 -all + DMARC reject).

  • MTA-STS + TLS-RPT published and in enforce mode.

  • Turn on Gmail advanced phishing & malware protections (spoofing, unauthenticated email, attachment protections, links). Set action to quarantine or warning, not "keep in inbox."

  • Security sandbox for attachments.

  • Disable auto-forwarding to external addresses

  • Restrict POP/IMAP

  • External sender warning banner on.

Drive And Sharing

  • External sharing off by default, or allowlist trusted partner domains only.

  • Disable "Anyone with the link" org-wide

  • Shared drives: restrict who can create them and who can add external members.

  • DLP rules for the obvious stuff (credentials, customer data, PII) start in audit mode, then block.

Logging And Detection

  • Ship Google Workspace logs to your SIEM.

  • High-value alerts:

    • super admin role granted

    • MFA disabled on any account

    • new DWD client or high-risk OAuth grant

    • external auto-forward rule created

    • mass download / mass external share in Drive

    • login from a new country for an admin

  • Consider using Gmail or Google Drive Canarytokens.

Quick wins if you only have an hour

  1. Count super admins → cut to 3.

  2. Disable external auto-forwarding.

  3. Block unconfigured third-party apps.

  4. Confirm DMARC is p=reject.