New security alerts for highly sensitive changes to Google Workspace configurations

What’s changing 

In the Alert Center, admins will now be notified of select critical and sensitive changes made to their Google Workspace configurations. Specifically, we will issue an alert when any of the following events are surfaced in the audit log: 
  • Changes to the primary admin 
  • SSO profile added: when a third-party SSO profile has been added and enabled for your organization. 
  • SSO profile updated: when a third-party SSO profile has been updated for your organization. 
  • SSO profile deleted: when a third-party SSO profile has been deleted for your organization. 
  • Password reset for super admins: when a password was reset for a super admin account. 

We plan to introduce alerts for more high risk actions over time — we will provide updates here once available. 

Who’s impacted 


Why it’s important 

These additional intelligent alerts will closely monitor several sensitive actions, making it easier for admins to stay on top of high risk changes to their environment and potentially malicious actions being taken by bad actors. 

For each alert, admins and super admins will receive an email notification with key information regarding the event. Once the alert is received, admins can use the security investigation tool to further investigate the incident. 

Getting started 

Rollout pace 


  • Available to all Google Workspace customers, as well as legacy G Suite Basic and Business customers