Tag Archives: Control Panel

Better scanning, more controls for Data Loss Prevention for Gmail

Last year we launched Data Loss Prevention (DLP) for Gmail, providing Google Apps Unlimited customers with another layer of protection to prevent sensitive information from being revealed to those who shouldn’t have it. Gmail DLP automatically checks all outgoing emails according to policies set by the Apps admin and prompts the appropriate action.

Today we’re excited to announce several new features for Gmail DLP:
Optical character recognition (OCR) for better attachment scanning 
Sensitive information can reside not just in text documents, but in scanned copies and images as well. With the new OCR enhancement, DLP policies can now analyze common image types, and extract text for policy evaluation. Admins have the option to enable OCR in the Admin console at the organizational-unit (OU) level for both the Content compliance and Objectionable content rules. 

Additional predefined content detectors
Our Work customers span the globe, and we are committed to providing customers in all countries with plug-and-play DLP policies. Towards this goal, we are pleased to announce the introduction of new detectors which cover personally identifiable information (PII) in several additional countries, and provide better coverage for HIPAA data as well.

More control over content detection thresholds
Our largest Work customers desire fine-grained control over DLP policies to minimize false positives, and take action commensurate with the level of perceived risk. We are introducing two new detection parameters to address this:
  • Count parameter - The count parameter allows customers to set up different DLP policies based on whether a message contains individual or bulk PII. For example, an email containing a single credit card number might be considered a low risk event, while one that contains 100 credit cards is clearly a high risk scenario. 
  • Confidence parameter - The confidence parameter lets the customer tighten or loosen detection criteria for the most commonly used detectors as per their needs. 

Check out the Help Center links below for more information on Gmail DLP and these new features. Stay tuned as we bring DLP to Google Drive later this year.

Note: Gmail DLP is available for Google Apps for Work Unlimited customers only. 

Launch Details
Release track:
Launching to both Rapid release and Scheduled release

Rollout pace: 
Full rollout (1-3 days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information 
Help Center: DLP for Gmail overview
Help Center: Optical character recognition
Help Center: New predefined detectors
Help Center: New detection parameters


Note: all launches are applicable to all Google Apps editions unless otherwise noted

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Mobile Management setup now simpler and quicker

Looking back at 2015, we can see that Google Apps Mobility Management has come a long way from an Android-only device management solution to a complete suite with native iOS support and app distribution across both the Android and iOS platforms. This has motivated many Apps admins to adopt our integrated solution, and we’re excited to help their employees be productive while keeping work data secure on their mobile devices.

As Mobile Management becomes increasingly important to admins, we want to make it even simpler to set up. With that in mind, today we’re making it easy for an admin to detect how many of their employees run the risk of accessing corporate data on unmanaged mobile devices and to establish a basic mobile security policy in the Admin console.

By simply clicking MANAGE NOW* on the Admin console landing page, admins can set up Mobile Management with a predefined set of security policies. Doing this will then allow those admins to take various actions, such as performing an account wipe of corporate data on mobile devices, viewing the inventory of all managed devices in a domain, and enforcing a basic password policy. To simplify the overall Mobile Management setup experience, we’ve also made it possible to set up Apple Push Certificates via the same wizard.




In addition, if an admin wants to use Google Mobile Management to set up Android for Work, we’ve made the process significantly simpler and quicker. Prior to this launch, admins needed to complete 15 different steps across four different sections of the Admin console to set up Android for Work. Starting today, they only need to complete one step to manage those devices in their domains. To get started, check out this Help Center article.


*Note that the option to MANAGE NOW will only show on the Admin console landing page if more than 80% of domain users are unmanaged.

Launch Details 
Release track:
Launching to both Rapid release and Scheduled release

Rollout pace: 
Gradual rollout (please note that these changes may take several weeks to propagate)

Impact: 
Admins only

Action: 
Admin action suggested/FYI

More Information 
Help Center: Android for Work setup overview

Note: all launches are applicable to all Google Apps editions unless otherwise noted

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Easier user management in the Google Admin mobile app for iOS

The Google Admin mobile app allows Apps super admins to easily manage users and groups, contact support, view audit logs and perform other common administrative tasks all from their mobile devices.

Following the recent upgrades to the Google Admin mobile app for Android, today’s launch adds similar functionality to the iOS app, making managing users even easier.

Add users from contact list 
When adding a new user, Apps super admins can now simply import a contact from their contact list and have all of their information pre-populated in the ‘Add user’ form. The information can then be edited as needed, and the user can be quickly created.
Check out the Help Center for more information on the Google Admin app for iOS.

Launch Details
Release track:
Launching to both Rapid release and Scheduled release

Rollout pace:
Full rollout (1-3 days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information
Help Center: Manage Google Apps from an iOS device
Help Center: Add a new user from your contacts
Get the Google Admin app in the App Store

Note: all launches are applicable to all Google Apps editions unless otherwise noted

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

More accurate reporting on Google Drive file sharing in the Admin console

Previously, we displayed the number of Google Drive files with owners in your domain that were externally visible, because they were shared publicly, because they were made visible to anyone with the link, or because they were shared with specific recipients outside of your domain. We showed these metrics in two places in the Admin console: (1) under Reports > Highlights, and (2) under Reports > Security.

Those metrics did not paint a complete picture, because they did not include sharing with consumer accounts and sharing with Google Groups with external members. With that in mind, we are working to improve our reporting on external Drive file sharing in the near future.

Until then, however, we want to ensure that the numbers you see in the Admin console are accurate and comprehensive. As a result, we’re removing the “Shared outside domain” metric from the Highlights report and the “Externally shared files” column from the Security report.

Highlights report


Security report


In addition to the changes described above, we’re making the names of the following sharing categories and events easier to understand and more consistent across the Admin console:
  • Under Reports > Highlights,
    • The “Document visibility” section is being renamed “Document Link Shared Status.”
    • “Externally visible files” are being renamed “External Link Shared Files.” This is the number of files shared publicly or with anyone with the link. This number does not include files that are shared only with specific recipients outside of your domain.
    • “Internally visible files” are being renamed “Internal Link Shared Files.” This is the number of files shared with a user’s entire domain, with anyone in a user’s domain who has the link, or with specific people in a user’s domain.
  • Under Reports > Security,
    • “Externally Visible files” are being renamed “External Link Shared Files.”
    • “Internally Visible files” are being renamed “Internal Link Shared Files.”
  • Under Reports > Audit > Drive*,
    • “Visibility change” is being renamed “Link Sharing visibility change.”
    • “Visibility access level change” is being renamed “Link Sharing Access Type Change.”

Check out the Help Center articles below for more information, and stay tuned for even more improvements to Drive file sharing reporting in the Admin console.

 *Note that the Drive audit report is only available to Google Apps Unlimited customers.

Launch Details
Release track:
Launching to both Rapid release and Scheduled release

Rollout pace:
Gradual rollout (3+ days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information
Help Center: Report highlights
Help Center: Security reports

Note: all launches are applicable to all Google Apps editions unless otherwise noted

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Increased control over Google Drive file sharing

When you share Google Drive files using Google Apps, we try our best to ensure that your recipients can actually access them. For instance, if you link to a Google Slides presentation in Gmail and that presentation hasn’t been shared with your recipient, we show you an option to share it before sending the email.



We also do this if you “+” someone into a comment in Docs, Sheets, or Slides, if you add someone to a protected range in Sheets, or if you attach a Google file to a Calendar invite (provided the person on the other end doesn’t already have access).

We’ve heard from many Apps admins, however, that they want greater control over the sharing options their employees have in these scenarios. In response to that feedback, today we’re introducing new Access Checker settings in the Admin console (Admin console > Apps > Google Apps > Settings for Drive > Sharing settings).

If an admin allows external, public file sharing (i.e. they’ve checked the box next to Allow users in XYZ domain to publish files on the web or make them visible to the world as public or unlisted files), that admin will now be able to say which of the following three options their users will have when sharing files in the scenarios described above:

  • Option 1: Recipients only, their domain, or public (no Google account required)
  • Option 2: Recipients only or their domain
  • Option 3: Recipients only



For example, if an admin chooses option 1 and an employee in their domain attaches a Google Sheets spreadsheet to an event in Calendar, that employee will be asked if they want to share that spreadsheet with guests of the event only or one of two additional options: (1) anyone in their domain with the link (if all guests are in their domain), or (2) anyone with the link (if any guests are in different domains).





At launch, for admins who allow external, public file sharing, “recipients only, their domain, or public” will be the option selected by default.

Alternatively, if an admin prohibits external, public file sharing, that admin will be able to choose which of the following two options their users see when sharing files in the scenarios described above:

  • Option 1: Recipients only or their domain
  • Option 2: Recipients only



For these admins, “recipients only or their domain” will be the option selected by default.

It’s important to note that the sharing options shown to users will be determined based on the settings in the document owner’s domain, which may not be the same as the settings in the domain of the person sharing the file. If someone tries to share multiple files and different policies apply to each (e.g. because the document owners are in different domains), we'll abide by the least permissive policy when showing options to users.

Consider this example: a user tries to send an email with three files attached—one file allows public sharing, and two allow sharing with recipients only. In that case, we’ll only offer the option to share with recipients, as that option abides by the least permissive policy associated with the files being shared.

Launch Details
Release track:
Launching to both Rapid release and Scheduled release

Rollout pace:
Full rollout (1–3 days for feature visibility)

Impact:
Admins and end users

Action:
Admin action required

More Information
Help Center

Note: all launches are applicable to all Google Apps editions unless otherwise noted

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

New admin control to suppress prompts when inviting external guests in Google Calendar

Today in Google Calendar for Work, when you create an event that includes one or more guests from outside of your domain, you’re prompted to confirm whether it’s okay to include external guests on the event invitation. Starting this week, domain administrators will be able to enable or disable these prompts from the Admin console.

From the Admin console, click Apps > Google Apps > Calendar > Sharing Settings > External invitations to enable or disable the invitation prompts when your users invite guests from outside of your domain.

Administrators who manage users through organizational units (OU) may also configure this setting on a per-OU basis. For example, if you have a Sales department that works with many external customers, you may disable the invitation prompts for those users but keep them enabled for your Engineering department.

This new setting will be enabled by default for all users, which is the same experience that users are accustomed to today. You can learn more in the Help Center.

Launch Details
Release track:
Launching to both Rapid release and Scheduled release

Rollout pace:
Full rollout (1-3 days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information
Help Center

Note: all launches are applicable to all Google Apps editions unless otherwise noted

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Book resources that are shared as ‘See only free/busy’ in Google Calendar

Currently, when Google Apps admins create a new calendar resource in the Admin console, it is shared as ‘See only free/busy’ with everyone in their domain when internal sharing options for secondary calendars are set to 'Hide event details.' However, this default behavior does not allow for these resources to be booked by users in the domain, and requires admins to share those resources with the domain as ‘See all event details.’

With today’s launch, a new setting has been added to the Admin console to allow users to book resources that are shared as ‘See only free/busy.’
This new setting has the following advantages:
  • Admins can now hide, by default, sensitive event information from users in their domain, without preventing those users from booking those resources. 
  • Admins no longer need to manually modify the sharing settings of each resource they create to make them available for booking from their domain. 
The setting will be defaulted off for all existing Apps customers, so existing configured resource booking settings will not change as a result of this launch. See the Help Center for more information.

Launch Details 
Release track:
Launching to both Rapid release and Scheduled release

Rollout pace:
Full rollout (1-3 days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information 
Help Center

Note: all launches are applicable to all Google Apps editions unless otherwise noted

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Hijacked account, password leak, and suspended for spamming alerts no longer included in Admin console notification inbox

Last year, based on customer requests to improve the overall impact of Admin console notifications and reduce their volume, we stopped including suspicious login alerts in the Admin console notification inbox. To further improve impact, we’ll now be doing the same for hijacked account, password leak, and suspended for spamming alerts. These alerts will continue to be sent via email.

This change will go into effect on January 14, 2016.

Launch Details
Release track:
Launching to both Rapid release and Scheduled release

Rollout pace:
Full rollout (1-3 days for feature visibility), starting on January 14, 2016

Impact:
Admins only

Action:
Admin action suggested/FYI


Note: all launches are applicable to all Google Apps editions unless otherwise noted

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Device management settings now easier to find and navigate in the Admin console

Google Apps Mobility Management allows admins to enforce policies on managed devices in their organizations via the device management settings page in the Admin console. With the continued evolution of our device management (MDM) and application management (MAM) capabilities, however, an ever-growing list of policy settings on a single page has become unwieldy for admins.

With that in mind, we’ve redesigned the device management experience by logically categorizing the settings, making them easier to find and use. For example, all settings applicable to Android devices are now grouped under Android Settings. There are six additional groups of settings: Setup, Password Settings, iOS Settings, Advanced Settings, Device Approvals, and App Management (the individual settings themselves have not changed).

Screen Shot 2015-12-02 at 2.43.35 PM.png

Screen Shot 2015-12-02 at 6.07.59 PM.png

Please note that this feature will roll out gradually and may not be available to 100% of domains until mid-Q1 2016.

Launch Details
Release track:
Launching to both Rapid release and Scheduled release

Rollout pace:
Gradual rollout (potentially longer than 3 days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information
Help Center: Configure mobile device settings

Note: all launches are applicable to all Google Apps editions unless otherwise noted

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Clean up of ‘Additional Google services’ section in Google Apps Admin console

When signing up for Google Apps, customers are provided with access to several additional free services, including YouTube, Blogger, Google Analytics, and many more. Admins can turn these services On or Off for their users in the Admin console by looking in Apps > Additional Google services.

Starting today, we’ll be cleaning up the list of services that are available and removing any services that have been shut down by Google in the last couple of years. These changes will have no impact on current On/Off service settings.   

Check out the Help Center for more information on accessing additional Google services.

Launch Details
Release track:  
Launching to both Rapid release and Scheduled release

Rollout pace: 
Gradual rollout (potentially longer than 3 days for feature visibility) to be completed in early January

Impact: 
Admins only

Action:
Admin action suggested/FYI

More Information
Help Center


Note: all launches are applicable to all Google Apps editions unless otherwise noted

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates