Tag Archives: Admin Console

Workspace data loss protection (DLP) for Gmail is now generally available

What’s changing 

A big threat organizations must prepare for is the risk of data exfiltration through unwanted and/or unauthorized means. Whether it’s small-scale, unintended sharing, or a larger breach scenario, organizations need powerful defenses to protect themselves from these risks. To that end, we’re pleased to announce that today Data Loss Prevention (DLP) is generally available in Gmail, alongside Drive and Chat.

DLP is one of the most powerful ways organizations can protect themselves from these risks. With DLP capabilities in Gmail, organizations can identify, monitor, and control the sharing of sensitive data. It works through a series of easy to apply data protection rules that can be implemented to instantly detect sensitive content in outgoing messages, including body content, attachments, headers, and subject lines. 


Additional details

How does DLP in Gmail compare to Content Compliance rules?
To prevent the exfiltration of sensitive data from Gmail, data protection rules with DLP are recommended. These rules offer a rich set of predefined detectors and the ability to build flexible conditions. 


Additionally, organizations can tailor warning messages based on their organization's data governance requirements, terminology, and processes; these messages will help educate users on their organization's specific security and data protection policies to prevent sharing sensitive content.


Other features, such as content compliance, can still be used for different purposes, like evaluating inbound messages and routing them internally to relevant departments.


For more information, please refer to our initial open beta announcement.


DLP within the Google Workspace ecosystem
As part of Google Workspace ecosystem, DLP for Gmail comes with capabilities available across other applications, such as Drive and Chat, so admins can configure, implement and investigate Data Loss Prevention incidents using unified tools, such as Security Investigation Tool, or build custom dashboards using unified audit logs or export to BigQuery. 


Taken together, DLP capabilities across Workspace provide powerful protections for organizations to reduce the risk of data breaches, comply with regulatory requirements, and protect their reputation and intellectual property.


Getting started

  • Admins: 
    • Data loss prevention rules can be configured at the domain, OU, or group level. DLP rules can be enabled in Gmail in the Admin console under Security > Access and data control > Data protection. Visit the Help Center to learn more about controlling sensitive data shared in Gmail. Note that you can modify existing DLP rules for Drive and Chat to also apply to Gmail. 
    • DLP events can be reviewed in the Security Investigation Tool or Security > Alert Center, if alerts are configured in rules.
    • With DLP for Gmail, data protection rules can be scanned synchronously or asynchronously. Visit our Help Center for more information.
    • For new rules, we recommend starting with “Audit only” mode. This allows you to thoroughly test and monitor the rule's performance and ensure it correctly identifies the intended data without interrupting email flow for users. Once you've validated the rule's behavior and are confident in its accuracy, you can then implement actions such as blocking or warning users as needed.

  • End users: Depending on your admin configuration, you’ll be notified if your message contains information that violates DLP rules.

Rollout pace


Availability

Available to Google Workspace:
  • Enterprise Standard, Enterprise Plus
  • Education Fundamentals, Standard, Plus, and the Teaching & Learning add-on
  • Frontline Standard
  • Cloud Identity Premium customers

Google Vault now supports the Gemini app

What’s changing 

Google Vault now supports the Gemini app (on web and mobile). Going forward, admins can use Vault for eDiscovery tasks to search Gemini app conversations and create an export of your search results. Specifically, the following actions can be taken around Gemini app data: 

  • Search prompts and responses with a number of filters, such as user and date to quickly refine your search. These searches can be across groups of users or by Organizational Units (OUs) up to 5000 in size. 
  • Export conversations in an XML format for the above searches via the UI or API.


Who’s impacted

Admins

Why it’s important

Vault is an eDiscovery and information governance tool for Google Workspace, which enables customers to retain, hold, search, and export users’ Google Workspace data. With this update, customers can now expand their regulatory and legal eDiscovery needs to include the Gemini app. This integration makes it easier for customers to comply with their eDiscovery obligations surrounding Gemini collaborative data, all from a central tool. 

Additionally, Vault’s integration with Gemini rounds out support for critical Workspace apps such as Gmail, Drive, Docs, Sheets, Slides, Chat, Calendar and Meet, providing customers with a consistent experience across all products that are managed within Vault for eDiscovery. Additional information governance and hold features, such as preview, retention, and litigation holds will follow in future releases. We’ll share more information on the Workspace updates blog when it’s available.

Additional details

This update is not applicable for Gemini for Google Workspace, as no prompts or responses are retained for those interactions. Visit our Privacy Hub for more information on how we’re protecting your Google Workspace data in the era of generative AI.

Getting started


Rollout pace


Availability

Available to Google Workspace
  • Business Plus
  • Enterprise Essentials and Enterprise Essentials Plus
  • Enterprise Standard and Enterprise Plus
  • Education Standard and Education Plus customers
  • Also available to customers with the Vault add-on license

Resources

Now generally available: Easily migrate files from Microsoft OneDrive to Google Drive

What’s changing

In October 2024, we expanded our data migration services to include the ability for Admins to transfer OneDrive data to Google Drive. This functionality is now generally available. You can migrate the files of up to 100 users at a time, including the files corresponding access permissions with shared members. 

With the general availability release, we’ve also added additional settings which admins can use to: 
  • Specify files to migrate within a certain date range.
  • Exclude specific file formats and large files. 
  • Skip uploading an identity map and allow Google to automatically map source and target users instead. 

Now that the tool is generally available, with more customization settings, you can quickly and easily migrate your data to Workspace at scale while minimizing disruption for end users. For more information, please refer to our original beta announcement.

Example of a completed migration.


Getting started


Rollout pace


Availability

Available to Google Workspace 
  • Business Starter, Standard, and Plus
  • Enterprise Standard and Plus
  • Education Fundamentals, Standard, Plus, and the Teaching and Learning add-on
  • Essentials Starter and Essentials
  • Enterprise Essentials and Enterprise Essentials Plus
  • Nonprofits

Resources


More options now available to customize digital signage on your Google Meet hardware

What’s changing 

In the coming weeks, admins will be able to use their Comeen or StratosMedia digital signage content on their Google Meet hardware devices. We know many of our customers use these tools for general digital signage needs within their organization and this update allows that content to be leveraged as screensavers across your Google Meet hardware fleet.

The Google Meet hardware ‘Screen Saver’  setting is located in the admin console under Devices > Google Meet hardware > Settings > Device settings



Additional details

  • Note that Comeen and StratosMedia are paid services and there may be additional costs associated with registering your devices on their platform. 
  • In some cases, this feature can conflict with the power-saving feature on your Meet hardware devices. To ensure that your custom screen saver is visible, be sure to set displays as active during working hours in the organizational unit you’re targeting. 
  • Screen savers are not interactive—tapping your touch controller or using the remote will cause the screen saver to be dismissed, and the device will return to displaying the agenda on the homepage. 

Getting started

  • Admins: Custom screen savers are opt-in and managed at the OU-level and apply to all devices in that organizational unit (OU). Visit the Help Center to learn more about how to display custom screen saver images.
Rollout pace

Availability

  • Available to all Google Workspace customers

Resources


Better understand app access with the new Access Evaluation log event

What’s changing 

We’re introducing a new log event, Access Evaluation, which will help admins better understand how security policies affect their users' access to OAuth apps. This includes settings and policies such as API controls, endpoint management configurations, domain wide delegation and more. The log contains information on the specific policies applied, when access was granted and the reasoning. Admins can use this information to review their security policies and revise them as needed to protect the sharing of Workspace data with users' apps.

Example of an Access Evaluation log


Getting started

  • Admins: Access Evaluation are available in the audit and investigation tool (Menu > Reporting > Audit and investigation > Access Evaluation log events), and the security investigation tool (Menu > Security > Security center > Investigation tool > Data source > Access Evaluation log events)  for specific Google Workspace editions. Visit the Help Center to learn more about Access Evaluation log events. 
  • End users: There is no end user impact or action required.

Rollout pace


Availability

  • Available in the audit and investigation tool for all Google Workspace customers.
  • Available in the security investigation tool for Google Workspace:
    • Frontline Standard
    • Enterprise Standard and Plus
    • Education Standard and Plus
    • Enterprise Essentials Plus
    • Cloud Identity Premium

Resources


Curate and customize the Chrome Web Store for your organization

What’s changing

Admins can now customize the Chrome Web Store experience for their users with several new options, including:

  • Branding and custom messaging: Add company logos, custom welcome banners and announcement banners.
  • Curated collections: Organize specific extensions for your users, including recommended and private extensions. We have also introduced a new collection of extensions that displays all items that are allowlisted by IT administrators.
  • Category controls: Hide specific extension categories to help streamline the browsing experience for users.

Additionally, we've enhanced the Chrome Web Store search experience. In the search results. end-users can quickly notice blocked item tags, and they can benefit from more advanced filtering such as a “Private items” filter.  

Example of a customized Chrome Web Store


Who’s impacted

Admins and end users


Why it matters 

Every Google Workspace customer has unique users with unique needs – Chrome extensions can help improve their workflows and increase productivity. However, navigating the numerous available extensions can present challenges for both admins and end users. For admins, it is often a manual and time consuming process to vet which Chrome extensions they want to allow for their users. For end users, it can be frustrating to sift through a vast catalog of extensions to find relevant and admin-approved extensions.

This update significantly improves the Chrome Web Store experience for enterprises. Admins can customize, organize, and control the Chrome Web Store experience for their users. For end users, finding work-relevant and admin approved extensions becomes significantly easier cutting down on guesswork or wasted time searching for extensions that might be blocked.


Getting started

  • Admins: Four new Apps & Extensions settings have been added to the Chrome section of the Admin console. To find the new settings, go to Menu > Chrome Browser > Apps and extensions > Navigate to the “Settings” tab > Chrome Web Store settings. Visit the Help Center to learn more about customizing the Chrome Web Store for your users.



Rollout pace


Availability

  • Available for all Google Workspace customers with access to the Admin console

Resources


Use tokens as placeholders for user specific information when configuring managed iOS applications

What’s changing

In May 2024, we launched the ability for admins to remotely configure managed iOS apps on end-user devices via Google Mobile Device Management. 

Beginning today, admins can use tokens in the app configurations for managed iOS apps. Tokens act as placeholders for information specific to a user or device that uses the app, such as a user's email address or their device serial number. Previously, configuration data was static, but this update gives admins the flexibility to configure devices dynamically according to various users and devices.

Creating the app configuration using XML information using a token placeholder


Getting started


Rollout pace


Availability

Available for Google Workspace:
  • Business Plus
  • Enterprise Standard and Plus
  • Enterprise Essentials and Essentials Plus
  • Education Standard and Plus
  • Nonprofits
  • Frontline Starter and Standard
  • Cloud Identity Premium 

Resources


Configure Google Meet hardware devices to trust private certificates

What’s changing

Google Meet hardware devices can now trust HTTPS certificates signed by a private certificate authority (CA). This simplifies the process of setting up and managing third-party user control interfaces (UCIs), especially in high impact meeting spaces with systems like Q-SYS.

Previously, you had to get certificates signed by a public CA to enable Google Meet hardware touch controllers to load third-party UCIs. This process was often time-consuming and expensive, and required frequent renewals.

Now, you can use private CAs to securely connect your Google Meet hardware with a third-party room control system's UCI. This gives you more control over your network security and eliminates the costs and complexities associated with public certificates.

Getting started

Admin console >Menu > Devices > Networks > Certificates


  • End users: There is no end user impact or action required.

Rollout pace


Availability

  • Available to all Google Workspace customers with Google Meet hardware devices
  • Please note that Android devices aren’t supported yet.

Resources

New Chrome Browser Profile Reporting for Workspace users available in the Admin console

What’s changing

For Google Workspace customers with Chrome Enterprise Core, we’re pleased to introduce a new Chrome browser profile list and reporting features for signed-in Google Workspace users. These new capabilities give IT administrators more insight into Chrome user profiles in their organization . The report includes a new managed profiles list and detail pages where IT administrators can find information such as profile details, browser versions, policies applied, extensions installed and more. The list of extensions installed allows you to identify versions of extensions that can potentially be a risk factor for your users.

Overall, this update significantly improves how admins analyze how their users are interacting with Chrome and allows them to take action to keep their users and data secure in Chrome.

Once enabled, you can view reports by going to Admin console > Chrome browser > Managed profiles



Getting started

  • Admins: Admins can simply log in to the Google Admin console and enable the Managed profile reporting policy. Visit the Help Center to learn more about viewing Chrome browser profile details.

To enable reporting, go to Menu > Devices > Chrome > Settings > User & browser settings > Chrome Browser > Browser Reporting > Managed Browser Reporting

  • End users: There is no end user impact or action required.

Prevent the downloading, printing, or copying of files by all users with Enhanced IRM for Google Drive Data-Loss Prevention

What’s changing 

Google Drive’s Information Rights Management (IRM) capability protects documents from data exfiltration actions, specifically downloading, printing, and copying. This is useful for making sure that sensitive content is protected from data leakage. 


Historically, this feature has only been applicable to users with either the “viewer” or “commenter” role, which has left administrators unable to apply the setting to users with either “owner” or “editor” roles. To address this, we’re expanding IRM to be applicable to all users, including file editors and owners, when it is applied by a Data Loss Prevention (DLP) rule.

The new Enhanced IRM action, as seen in the DLP Rule creation flow.



Additional details

When an editor or owner is affected by IRM, they will retain the ability to copy and paste document content, but they may only do so within that document. Attempting to paste content outside of the document will not succeed. For more information, please refer to the help center content.


Getting started

  • Admins: DLP rules and CAA levels are applied per-file based on how these rules are configured.
  • End users: Only administrators can set IRM for all user roles on a file. File owners may still only set IRM for viewers and commenters. If a file has both an administrator-applied IRM setting and a file owner setting on it, the administrator setting takes priority. Once this feature is enabled, all entry points for downloading, printing, and copying will be removed from Google Drive, Docs, Sheets, and Slides on all platforms. Visit the Help Center to learn more about stopping, limiting, or changing how your files are shared.
A view of the file owner’s IRM setting when an overriding administrator setting is present.

Rollout pace


Availability

  • IRM controls are available for all Google Workspace customers
  • Data Loss Prevention Rules and Context-Aware Access conditions are available for Google Workspace:
    • Enterprise Standard and Plus
    • Education Fundamentals, Standard, Plus, and the Teaching and Learning add-on
    • Frontline Standard
    • Enterprise Essentials and Enterprise Essentials Plus

Resources