Tag Archives: Admin Console

Use Access Approvals to control data access during support or maintenance

What’s changing 

Today, we’re introducing Access Approvals, which builds on Access Transparency and Access Management. Access Approvals allows customers to explicitly approve or deny Google employees access to data during support and general maintenance. Access approvals will be rolling out over the course of the next several weeks.


We’ve designed our systems to limit the number of employees that have access to customer data and to actively monitor the activities of those employees. Access Approvals allows our customers to set up granular controls—at an organizational unit or admin group level—to require explicit permission for Google to access covered content for a limited time period.




Who’s impacted 

Admins 


Why it’s important 

Access Approvals provides admins granular control over how Google accesses that data when support requests are initiated or maintenance is being performed. Critically, this gives customers the ability to approve or decline access on individual requests. 


We know it’s essential that our customers have visibility and control over their systems and how they’re accessed by Google. This update, along with Sovereign Controls for Google Workspace, Client-side encryption, data regions, and Access Management capabilities, provide solutions for our customers to reach their digital sovereignty goals. 


Getting started 


Rollout pace 


Availability 

  • Access Approvals is part of Google Workspace Assured Controls, which is available as an add-on for Google Workspace Enterprise Plus customers only. For more information, contact your Google account representative. 

Resources 

Google Workspace Updates Weekly Recap – November 11, 2022

New updates 

Unless otherwise indicated, the features below are fully launched or in the process of rolling out (rollouts should take no more than 15 business days to complete), launching to both Rapid and Scheduled Release at the same time (if not, each stage of rollout should take no more than 15 business days to complete), and available to all Google Workspace and G Suite customers. 



Easily assign Tasks from Google Docs on mobile
Earlier this year, we made it easier for you to assign Tasks from Google Docs. This enables you to assign a checklist item to yourself or a colleague that will then show up in the assignee’s Tasks list. When edits are made to an assigned item in Tasks, such as a change to the title, due date or completion state, those updates will show in the Doc, and vice versa. We’re excited to announce that this is now available on the Docs Android and iOS apps. | Learn more here and here.



Previous announcements


The announcements below were published on the Workspace Updates blog earlier this week. Please refer to the original blog posts for complete details.



The new Gmail user interface is becoming the standard experience
At the beginning of 2022, we announced a new user interface and a customizable, integrated view for Gmail, bringing critical applications like Gmail, Chat, and Meet in one unified location. Starting this month, this user interface will become the standard experience for Gmail, with no option to revert back to the “original view.” With the new UI, users are still able to change their Gmail theme, inbox type, and more through quick settings. | Available to Google Workspace Business Starter, Business Standard, Business Plus, Enterprise Essentials, Enterprise Standard, Enterprise Plus, Education Fundamentals, Education Plus, Frontline, and Nonprofits, as well as legacy G Suite Basic and Business customers only. | Learn more.



Trust rules in Google Drive now generally available
In July 2022, we announced an open beta for trust rules in Google Drive. Beginning today, this feature will become available for eligible Google Workspace customers. Trust rules give admins more control over how files can be shared, both within and outside of their organization. For example, admins can limit what specific departments can access versus other parts of their organization. See our original announcement for more information. | Available to Google Workspace Enterprise Plus, Enterprise Standard, Education Plus, and Education Standard customers only. | Learn more. 



Use Key Migration to change or add key services for Client-side encryption
As we continue to expand Client-side encryption (CSE) across Google Workspace products, we’re introducing Key Migration which allows admins to enable additional key services or change their existing key service. In both cases, built-in controls ensure key migrations are performed safely, with support for backup key services and potential roll backs. These ensure encrypted data remains inaccessible to Google and fidelity is maintained through the migration process. | Available to Google Workspace Enterprise Plus, Education Standard, and Education Plus customers only. | Learn more. 


For a recap of announcements in the past six months, check out What’s new in Google Workspace (recent releases).

Use Key Migration to change or add key services for Client-side encryption

What’s changing 

As we continue to expand Client-side encryption (CSE) across Google Workspace products, we’re introducing Key Migration which allows admins to enable additional key services or change their existing key service. In both cases, built-in controls ensure key migrations are performed safely, with support for backup key services and potential roll backs. These ensure encrypted data remains inaccessible to Google and fidelity is maintained through the migration process. 




Who’s impacted 

Admins 


Why it’s important 

Client-side encryption gives admins direct control of their encryption keys and the identity service that they choose to authenticate for those keys. Google never has access to the keys, rendering the data indecipherable, which may help organizations meet regulatory compliance in many regions. 


This update gives admins the flexibility to perform key rotations that best suit their organizational policies—including having different key services —or resolve key service availability issues. Customers can add a new key, assign it to an organizational unit or group and migrate any content encrypted by the previous key to be encrypted by the new key. During this migration process the new key is backed up by an existing key as a safeguard mechanism. Once customers are confident in their new key and have completed any migrations they can remove the backup key. 


Additionally, this release provides more granular control for our customers in maintaining their encryption keys by accommodating situations where they may choose to switch key service providers, move from on-premise to a managed service, and migrate encrypted content. 


Getting started 


Rollout pace 


Availability 

  • Available to Google Workspace Enterprise Plus, Education Standard, and Education Plus customers 

Resources

Trust rules in Google Drive now generally available

What’s changing 

In July 2022, we announced an open beta for trust rules in Google Drive. Beginning today, this feature will become available for eligible Google Workspace customers. 

Trust rules give admins more control over how files can be shared, both within and outside of their organization. For example, admins can limit what specific departments can access versus other parts of their organization. See our original announcement for more information. 



Getting started 

  • Admins: Eligible Admins can enable this feature in the Admin console by going to the Rules > Turn on trust rules. Visit the Help Center to learn more about trust rules. 


  • End users: Your Admin’s trust rules will determine who you can share and collaborate with on Drive files.

Rollout pace 


Availability 

  • Available to Google Workspace Enterprise Plus, Enterprise Standard, Education Plus, and Education Standard Customers 
  • Not available to Google Workspace Essentials, Business Starter, Business Standard, Business Plus, Enterprise Essentials, Education Fundamentals, Frontline, and Nonprofits, as well as G Suite Basic and Business customers 

Resources 

Google Workspace Updates Weekly Recap – October 28, 2022

New updates 

Unless otherwise indicated, the features below are fully launched or in the process of rolling out (rollouts should take no more than 15 business days to complete), launching to both Rapid and Scheduled Release at the same time (if not, each stage of rollout should take no more than 15 business days to complete), and available to all Google Workspace and G Suite customers. 



New keyboard shortcuts for Keep
In continuing our efforts to provide a top-class user experience on large screen devices, we’re releasing updated keyboard shortcuts for Keep on Android that better align with the web experience. | View the full list of shortcuts and learn more here. 

Enhancing spell check in Google Docs
Words whose spelling is not recognized will now be underlined in red, even if there is no suggestion. When you click on such a word, you'll see it labeled as an "unknown word" -- from here you can choose to add the word to your personal dictionary or ignore the suggestion. This improvement will highlight more potential spelling errors - helping you write correctly and with confidence. Note that this feature is only available in English at this time. | Learn more. 
Improved hearing aid support for Google Meet on Android
We’ve expanded Google Meet hearing aid support on Android devices to recognize a wider variety of hearing aid devices. Meet will automatically default to using hearing aid support when they’re connected. You can also select hearing aids during a meeting from the audio settings menu. If the hearing aid has a built-in microphone, this microphone will be used. If it doesn’t the mobile phone or tablet microphone will be used.

Previous announcements


The announcements below were published on the Workspace Updates blog earlier this week. Please refer to the original blog posts for complete details.



Use built-in mail merge tags like @firstname to personalize multi-send emails
We’ve launched the ability to personalize multi-send emails with mail merge tags like @firstname and @lastname. | Available to Google Workspace Business Standard, Business Plus, Enterprise Starter, Enterprise Standard, Enterprise Plus, Education Plus, and Workspace Individual customers only. | Learn more.


Stronger Admin console protection with risk-based re-authentication challenges
In August 2022, we announced strengthened safeguards for sensitive actions taken in your Google Workspace end users accounts. Specifically, this update protected users from bad actors taking over accounts via cookie theft. Beginning this week, we’re extending this protection to the Admin console. | Learn more.


Custom emojis coming to Chat
We’re making emojis even more expressive and personalized by allowing people to create custom emojis. Everyone in an organization can view and use custom emojis uploaded by their colleagues in Chat messages and reactions. | Learn more. 


Save time by adding in grading category information before exporting Google Assignments in Google Classroom
Starting this week, teachers can include grading category information when exporting Google Classroom assignments to the SIS. | Available to Education Fundamentals, Education Plus, Education Standard, the Teaching and Learning Upgrade, and Aspen and Skyward 2.0 (SaaS Customers Only) SIS customers only. | Learn more.


Create and manage AppSheet databases, available in public preview
AppSheet is Google’s platform for building and deploying end-to-end apps and automation without writing code. As we continue to enhance and streamline app creation, we’re introducing a built-in structured database in public preview. | Available to Google Workspace Enterprise Plus customers, as well as those with an AppSheet license. | Learn more. 


Configure App Access Control for third-party applications in bulk
You can now use that CSV file to specify the status of each app—trusted, blocked, or limited—and upload the file back into the Admin console for updates. | Available to Google Workspace Business Starter, Business Standard, Business Plus, Enterprise Essentials, Enterprise Standard, Enterprise Plus, Education Fundamentals, Education Plus, Education Standard, the Teaching and Learning Upgrade, Frontline, and Nonprofits, legacy G Suite Basic and Business, and Cloud Identity Pro customers only. | Learn more. 





For a recap of announcements in the past six months, check out What’s new in Google Workspace (recent releases).

Google Workspace Updates Weekly Recap – October 28, 2022

New updates 

Unless otherwise indicated, the features below are fully launched or in the process of rolling out (rollouts should take no more than 15 business days to complete), launching to both Rapid and Scheduled Release at the same time (if not, each stage of rollout should take no more than 15 business days to complete), and available to all Google Workspace and G Suite customers. 



New keyboard shortcuts for Keep
In continuing our efforts to provide a top-class user experience on large screen devices, we’re releasing updated keyboard shortcuts for Keep on Android that better align with the web experience. | View the full list of shortcuts and learn more here. 

Enhancing spell check in Google Docs
Words whose spelling is not recognized will now be underlined in red, even if there is no suggestion. When you click on such a word, you'll see it labeled as an "unknown word" -- from here you can choose to add the word to your personal dictionary or ignore the suggestion. This improvement will highlight more potential spelling errors - helping you write correctly and with confidence. Note that this feature is only available in English at this time. | Learn more. 
Improved hearing aid support for Google Meet on Android
We’ve expanded Google Meet hearing aid support on Android devices to recognize a wider variety of hearing aid devices. Meet will automatically default to using hearing aid support when they’re connected. You can also select hearing aids during a meeting from the audio settings menu. If the hearing aid has a built-in microphone, this microphone will be used. If it doesn’t the mobile phone or tablet microphone will be used.

Previous announcements


The announcements below were published on the Workspace Updates blog earlier this week. Please refer to the original blog posts for complete details.



Use built-in mail merge tags like @firstname to personalize multi-send emails
We’ve launched the ability to personalize multi-send emails with mail merge tags like @firstname and @lastname. | Available to Google Workspace Business Standard, Business Plus, Enterprise Starter, Enterprise Standard, Enterprise Plus, Education Plus, and Workspace Individual customers only. | Learn more.


Stronger Admin console protection with risk-based re-authentication challenges
In August 2022, we announced strengthened safeguards for sensitive actions taken in your Google Workspace end users accounts. Specifically, this update protected users from bad actors taking over accounts via cookie theft. Beginning this week, we’re extending this protection to the Admin console. | Learn more.


Custom emojis coming to Chat
We’re making emojis even more expressive and personalized by allowing people to create custom emojis. Everyone in an organization can view and use custom emojis uploaded by their colleagues in Chat messages and reactions. | Learn more. 


Save time by adding in grading category information before exporting Google Assignments in Google Classroom
Starting this week, teachers can include grading category information when exporting Google Classroom assignments to the SIS. | Available to Education Fundamentals, Education Plus, Education Standard, the Teaching and Learning Upgrade, and Aspen and Skyward 2.0 (SaaS Customers Only) SIS customers only. | Learn more.


Create and manage AppSheet databases, available in public preview
AppSheet is Google’s platform for building and deploying end-to-end apps and automation without writing code. As we continue to enhance and streamline app creation, we’re introducing a built-in structured database in public preview. | Available to Google Workspace Enterprise Plus customers, as well as those with an AppSheet license. | Learn more. 


Configure App Access Control for third-party applications in bulk
You can now use that CSV file to specify the status of each app—trusted, blocked, or limited—and upload the file back into the Admin console for updates. | Available to Google Workspace Business Starter, Business Standard, Business Plus, Enterprise Essentials, Enterprise Standard, Enterprise Plus, Education Fundamentals, Education Plus, Education Standard, the Teaching and Learning Upgrade, Frontline, and Nonprofits, legacy G Suite Basic and Business, and Cloud Identity Pro customers only. | Learn more. 





For a recap of announcements in the past six months, check out What’s new in Google Workspace (recent releases).

Configure App Access Control for third-party applications in bulk

What’s changing 

Currently, you can download and view a CSV file with information on accessed and configured apps. Now, you can use that CSV file to specify the status of each app—trusted, blocked, or limited—and upload the file back into the Admin console for updates. 





In the Admin console, under Security > API Controls > App Access Controls, you’ll see the option to “Bulk update list”. 


Controlling how apps across your organization access Google Workspace data is critical to the security of your end users and sensitive data. This change makes it easier for Admins to set these policies in bulk, versus taking these actions individually, which can be time consuming. 


Getting started 


Rollout pace


Availability 

  • Available to Google Workspace Business Starter, Business Standard, Business Plus, Enterprise Essentials, Enterprise Standard, Enterprise Plus, Education Fundamentals, Education Plus, Education Standard, the Teaching and Learning Upgrade, Frontline, and Nonprofits, as well as legacy G Suite Basic and Business customers 
  • Available to Cloud Identity Pro customers 
  • Not available to Google Workspace Essentials customers 

Resources 

Custom emojis coming to Chat

This announcement was made at Google Cloud Next ‘22. Visit the Cloud Blog to learn more about the latest Google Workspace innovations for the ever-changing world of work. 

What’s changing

Emojis are a great way for people to express themselves in Google Chat. We're excited to announce that we're making emojis even more expressive and personalized by allowing people to create custom emojis. Everyone in an organization can view and use custom emojis uploaded by their colleagues in Chat messages and reactions. 

Before launching to end users, admins can set organizational guidelines and designate emoji managers who can browse and delete custom emojis that do not adhere to the company’s guidelines. These admin controls will begin rolling out before the end user functionality to create custom emojis is available. See the "Rollout" section below for more information. 


Who’s impacted 

Admins and end users 


Why it matters 

As one of our top feature requests, custom emojis help teams develop their culture and enable people to express themselves more authentically in Chat. 


Getting started 

  • Admins: This feature will be ON by default for everyone in the organization. Admins can limit who can create new custom emojis, including turning it OFF for everyone at the organizational unit level. Admins can also designate emoji managers at the organizational unit level. 
    • Within the Admin console, navigate to Apps > Google Workspace > Settings for Google Chat and classic Hangouts > Emoji Options. 
    • To limit the creation of custom emojis, select the top-level organizational unit and turn OFF “Allow users to create custom emojis.” You can then turn it ON for specific child organizational units. 
    • To designate emoji managers, select the organizational unit for that role and turn ON “Allow users to manage all custom emojis.” 
    • Visit the Help Center to learn more about managing custom emoji permissions. 
  • End users: 
    • If the creation of custom emojis is enabled for your organizational unit, you can create custom emojis in the web versions of Chat or Gmail by navigating to the “Create” button within the emoji picker. There, you can upload an image of your choice and give it a descriptive name, and then use your custom emoji while sending or reacting to messages in Chat. 
      • Note: Custom emojis you create can be viewed and used by everyone in your organization. 
    • To use custom emojis, navigate to the “Custom Emojis” tab within the emoji picker in messages and reactions. You will then see custom emojis created by everyone in your organization that are available for you to use. 
      • Note: Custom emojis are only available in conversations without guests or external participants. 
    • Help Center content will be added shortly. 

Rollout pace 

Admin controls: 
End-user functionality: 

Availability 

  • Available to all Google Workspace customers, as well as legacy G Suite Basic and Business customers
  • Not available to users with personal Google Accounts 

Resources 

Stronger Admin console protection with risk-based re-authentication challenges

What’s changing 

In August 2022, we announced strengthened safeguards for sensitive actions taken in your Google Workspace end users accounts. Specifically, this update protected users from bad actors taking over accounts via cookie theft. Beginning today, we’re extending this protection to the Admin console. 


Currently, the Admin console prompts users to re-authenticate every hour. We are extending our current protections with additional signals to detect potential cookie theft. If a risky session is detected, we will issue extra challenges such as mobile notifications or the use of a security key. Once the user has successfully verified, they’ll be directed back to the admin page they came from. 



Who’s impacted 

Admins 


Why it’s important 

This added layer of security helps to intercept bad actors who have gained access to the Admin console using a stolen cookie. Cookie theft is a session hijacking technique whereby accounts can be accessed by exploiting cookies stored in the browser. 


The additional “Verify it’s you” challenges help ensure only authorized users are accessing your organization’s sensitive information and data, preventing bad actors from taking damaging actors. Further, these challenge attempts will be logged as Admin log events allowing for further admin investigation. 



Additional details 

To avoid situations where a bad actor has a cookie that marks a device as trusted, admins can configure a device to be trusted based upon login. 




If an admin gets legitimately stuck trying to access the Admin console, other admins can temporarily turn off login challenges, including additional log-in challenges. We strongly recommend only using this option if contact with the user is credibly established, such as via a video call. 



Getting started 


Rollout pace 


Availability 

  • Available to all Google Workspace customers, as well as legacy G Suite Basic and Business customers 

Resources

Google Workspace Client-side encryption beta expanded to include Google Calendar

 This announcement was made at Google Cloud Next ‘22. Visit the Cloud Blog to learn more about the latest Google Workspace innovations for the ever-changing world of work. 


What’s changing 

In 2021, we announced Google Workspace Client-side encryption to help customers strengthen the confidentiality of their data while helping to address a broad range of data sovereignty and compliance requirements. 


Since then, we’ve made this feature available for Google Meet, Drive, Docs, Sheets, and Slides, with support for multiple file types including Office files, PDFs, and more. Today, we’re happy to announce the beta for Client-side encryption for Google Calendar. When using Client-side encryption for Calendar events, your event description, attachments, and Meet data is indecipherable to Google servers. You have control over encryption keys and the identity service to access those keys. 


Google Workspace Enterprise Plus, Education Plus, and Education Standard customers are eligible to apply for the beta here until November 11, 2022. 

Who’s impacted 

Admins and end users 


Why it’s important 

Google Workspace already uses the latest cryptographic standards to encrypt all data at rest and in transit between our facilities. With Client-side encryption, we’re taking this a step further by giving customers direct control of encryption keys and the identity provider used to access those keys. This can help you strengthen the confidentiality of your data while helping to address a broad range of data sovereignty and compliance needs. 


When using Client-side encryption, your event description, attachments, and Meet data is indecipherable to Google. You can create a fundamentally stronger privacy posture, whether that’s to help your organization comply with regulations like ITAR and CJIS or simply to better protect the privacy of your confidential data. 


Getting started 

  • Admins: This feature will be OFF by default and can be enabled at the domain, OU, and Group levels by going to the Admin console > Security > Access and data control > Client-side encryption. Visit the Help Center to learn more about client side encryption. 
  • End users: 
    • You will need to be logged in with your Identity Provider to have access to encrypted content.
    • To add encryption to any event in Calendar, click on the shield icon at the top of the event creation card. This will add encryption to event description, attachments, and Meet, while other items such as event tile, time, and guests remain on standard encryption. 

Availability 

  • Available to Google Workspace Enterprise Plus, Education Plus, and Education Standard customers 
  • Not available to Google Workspace Essentials, Business Starter, Business Standard, Business Plus, Enterprise Essentials, Education Fundamentals, Frontline, and Nonprofits, as well as legacy G Suite Basic and Business customers 
  • Not available to users with personal Google Accounts 

Resources