Tag Archives: MDM

Helping G Suite customers stay secure with new proactive phishing protections and management controls

(Cross-posted from The Keyword)

Security tools are only effective at stopping threats if they are deployed and managed at scale, but getting everyone in your organization to adopt these tools ultimately hinges on how easy they are to use. It’s for this reason that G Suite has always aimed to give IT admins simpler ways to manage access, control devices, ensure compliance and keep data secure.

Today we announced more than 20 updates to deepen and expand Google Cloud customers’ control over their security. Many of these features will be turned on by default for G Suite so that you can be sure the right protections are in place for your organization. And, even better, in most cases your users won’t have to do a thing. Here’s the breakdown.

1. Helping to protect your users and organization with new advanced anti-phishing capabilities

We're applying machine learning (ML) to billions of threat indicators and evolving our models to quickly identify what could be a phishing attack in the making. Information from these self-learning ML models helps us flag suspicious content. At the same time, updated phishing security controls can be configured to automatically switch on the latest Google-recommended defenses.

These new protections can:
  • Automatically flag emails from untrusted senders that have encrypted attachments or embedded scripts.
  • Warn against email that tries to spoof employee names or that comes from a domain that looks similar to your own domain.
  • Offer enhanced protections against spear phishing attacks by flagging unauthenticated email.
  • Scan images for phishing indicators and expand shortened URLs to uncover malicious links.


With the protections we have in place, more than 99.9% of Business Email Compromise (BEC) scenarios—or when someone impersonates an executive to get sensitive information—are either automatically moved to the spam folder or flagged with anomaly warnings to users.


For more details, G Suite admins should read our related post on the G Suite Updates blog.

2. Giving you more control over mobile devices with default-on mobile management

Securing endpoints like mobile devices is one of the best ways for businesses to keep data safe. More than 7 million devices are already managed with G Suite’s enterprise-grade mobile management solution. With new proactive security settings, basic device management for your mobile devices that access G Suite is automatically enabled.

This means employees don’t have to install profiles on iOS and Android devices. It also means admins get added security management controls to help them:
  • See which devices access corporate data in a single dashboard.
  • Enforce pass codes and erase confidential data with selective account wipe for Android and iOS.
  • Automatically protect Android and iOS devices, with no user intervention or device profile required.

For more details, G Suite admins should read our related post on the G Suite Updates blog.

And you may have noticed we launched updates to Cloud Identity—a way for enterprises to manage users, apps and devices centrally. Cloud Identity includes user lifecycle management, account security, SSO, robust device and app management and unified reporting. Check it out.



3. Offering you more visibility and insights to stay ahead of potential threats

IT admins who operate in the cloud seek tools, visibility and assistive insights to stop threats or gaps in operations before they become security incidents. This is why we introduced the security center for G Suite earlier this year. The security center is a tool that brings together security analytics, actionable insights and best practice recommendations from Google to help you protect your organization, data and users.

Today, we’re introducing additions to the security center for G Suite including:
  • New security charts to show OAuth activity and Business Email Compromise (BEC) scam threats that are specifically focused on phishing emails that may not have links.
  • New mobile management charts to help IT admins examine activity analytics and show when devices have been hijacked, rooted or jailbroken, as well as when other suspicious device activity has been detected.
  • Ways to reorganize the dashboard to focus on what is most important to your organization.
  • Ways to analyze your organization’s security health and get custom advice on security key deployment and protection against phishing scams.



If you’re new to using the G Suite security center, check out these instructions to get started. Note that only admins with G Suite Enterprise licenses can access the security center.

4. Providing built-in protections and controls for Team Drives

Enterprises share and store an enormous amount of content, which means admins need more controls to keep this data protected. That’s why we’re enhancing Team Drives with new security controls to give you more ways to safeguard highly-sensitive content. Now, your data can be protected by Information Rights Management (IRM) controls so you can feel confident that your company’s ideas stay “yours.”



Specific updates include the ability to modify settings for Team Drives to:

  • Limit file access privileges to Team Drives members, or only to users within your domain.
  • Add IRM controls to prevent users from printing, downloading and copying files within Team Drives. 

These new security features for Team Drives will roll out over the next few weeks. Monitor the G Suite Updates blog and G Suite release calendar for more information when these features launch.

Get started

Phishing and mobile management controls are available now across all G Suite versions, and you’ll be able to use Team Drives controls in the coming weeks. If you’re a G Suite Enterprise customer, you can access the security center in the Admin console.



Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Stay secure with default-on mobile management

We recently introduced several features for G Suite to help keep your data secure. As described in our earlier post, this includes basic mobile management that’s on by default. Keep reading for more information on this new setting configuration and how it’ll be rolled out to your organization.

If your users bring their Android and iOS devices to work, you have the option to turn on mobile device management for additional security.

If you’ve never enabled this option, we will automatically turn on basic mobile management for your domain by the end of the year. This means that any user who doesn’t currently have a passcode or screen lock on their device will be required to set one up before accessing their G Suite apps.

To control the timing of this change, you can do one of three things:
  1. Turn on basic mobile management now, and enforce a passcode on your users' devices.
  2. Turn on basic mobile management now, but don't enforce a passcode on your users' devices.
  3. Enable and then disable mobile management. This will prevent basic mobile management from being turned on automatically.

If you do any of the above, passcodes and screen locks will not be automatically enforced at any point in the future.

A few important things to keep in mind:
  • If your organization has previously enabled basic, advanced, or custom mobile management, your users won’t be impacted by this launch.
  • This launch applies even if your organization uses a third-party Enterprise Mobility Management (EMM) provider. It won’t impact the way your EMM works in any way.
  • Mobile devices syncing via Google Sync won’t be impacted by this change and won’t have a passcode or screen lock enforced.
  • Users who sync their mail via IMAP and who don’t use native G Suite apps (e.g. Gmail) won’t be impacted by this change, and their devices won’t have a passcode or screen lock enforced.


For more information on Google Mobile Management, please visit the Help Center.

Launch Details
Release track:
Launching to both Rapid Release and Scheduled Release by the end of 2018

Editions:
Available to all G Suite editions

Rollout pace:
Extended rollout (potentially longer than 15 days for feature visibility)

Impact:
Admins and end users

Action:
Admin action suggested/FYI

More Information
Help Center: Turn on mobile device management
Help Center: Compare mobile management features
The Keyword: Helping G Suite customers stay secure with new proactive phishing protections and management controls


Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Manage app runtime permissions on Android devices with Google Mobile Management

We know that to best protect your organizations and better serve your employees, you need increased control over the applications running on their mobile devices. With this launch, we’re doing just that. Going forward, G Suite admins can manage permissions that Android apps request at runtime, as opposed to at installation time (also known as “runtime permissions”). Note that this feature is only available for apps running in work profiles or on company-owned devices.

Generally, an app requests permission at runtime when it’s attempting to access sensitive data, like a user’s location, contacts, calendar, microphone, or storage. These permissions have to be explicitly granted by the user at that moment, and not just when the app is installed. See below for an example.


To help you better manage runtime permissions for Android apps*, we’re introducing two new settings in the Admin console for customers using Google Mobile Management.

The first will give G Suite admins three options for management of all runtime permissions on all Android apps: (1) allow runtime permissions automatically, (2) deny runtime permissions automatically, or (3) prompt the end user to choose whether to grant runtime permissions. The last setting is the default; it can be changed in the Admin console under Device Management > Android Settings > Apps and Data Sharing.


The second setting can be found under the App Distribution and Configuration options provided when an Android app is whitelisted. This setting will allow admins to manage runtime permissions for that specific app. For example, an admin can forbid the app to access the device’s location or contacts. Where there are conflicts, this setting will take priority over the app-wide setting mentioned above.



*IMPORTANT: Android apps will only request permissions at runtime if the device is running Android 6.0 (Marshmallow) or higher and the app itself targets API level 23 or higher. The second setting mentioned above will be greyed out in Admin console if the app doesn’t target API23+. If you’re unsure of whether an app will request runtime permissions, we recommend contacting the app developer.

Launch Details
Release track:
Launching to both Rapid Release and Scheduled Release

Editions:
Available to all G Suite editions

Rollout pace:
Gradual rollout (up to 15 days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information
Help Center: Manage apps on mobile devices
Help Center: Apply settings for Android mobile devices


Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Manage Android devices without the Google Apps Device Policy app

Last year, we launched Basic Mobile Management for iOS—the ability to manage employees’ iOS devices, even if those employees don’t set up MDM agents or profiles. We’re now bringing this same feature to Android.

Starting today, G Suite admins can mandate basic security measures on the Android devices their employees bring to work, without requiring those employees to install the Google Apps Device Policy app on their devices. To do so, admins simply need to select “Basic” under Device management > Setup > Mobile Management > Enable Mobile Management in the Admin console.


When Basic Mobile Management is enabled, admins can:
  • Enforce a device screen lock.*
  • Wipe a corporate account (but not the entire device).
  • View, search, and manage their device inventory.

Basic Mobile Management makes life easier for end users as well, because it allows them to access their corporate accounts without risking their personal data being wiped.

For more details, check out the Help Center.

*Please note that you can only enforce a screen lock on devices running Android L or earlier if those devices have the Google Apps Device Policy app installed.

Launch Details
Release track:
Launching to both Rapid Release and Scheduled Release

Editions:
Available to all G Suite editions

Rollout pace:
Gradual rollout (up to 15 days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information
Help Center: Set up mobile device management


Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Publish private apps to multiple organizations

Businesses using Google Mobile Management and other Enterprise Mobility Management (EMM) providers can publish Android apps customized for their workplace directly to their managed Google Play store, where their employees can easily access and install them. In some cases, these customers have set up multiple “organizations” within their domain (e.g. to serve different regions, for testing purposes, etc.), each of which needs access to the custom app. To meet this need, we recently made it possible to publish a single private app to up to 20 organizations. This has several advantages:
  1. Developers can publish apps to domains other than their own (including developers with personal @gmail.com accounts).
  2. Developers no longer need to be admins of the organizations they’re publishing to.
  3. Businesses can more easily delegate app publishing to third-party developers.
  4. Private app publishing remains secure, because the developer must have the target organization’s Organization ID and an admin must approve any apps targeted to their organization.


For more information, please see the Help Center.

Launch Details
Release track:
Available to both Rapid Release and Scheduled Release

Editions:
Available to all G Suite editions

Impact:
All end users

Action:
Change management suggested/FYI

More Information
Help Center: Publish private apps


Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Publish private apps to multiple organizations

Businesses using Google Mobile Management and other Enterprise Mobility Management (EMM) providers can publish Android apps customized for their workplace directly to their managed Google Play store, where their employees can easily access and install them. In some cases, these customers have set up multiple “organizations” within their domain (e.g. to serve different regions, for testing purposes, etc.), each of which needs access to the custom app. To meet this need, we recently made it possible to publish a single private app to up to 20 organizations. This has several advantages:
  1. Developers can publish apps to domains other than their own (including developers with personal @gmail.com accounts).
  2. Developers no longer need to be admins of the organizations they’re publishing to.
  3. Businesses can more easily delegate app publishing to third-party developers.
  4. Private app publishing remains secure, because the developer must have the target organization’s Organization ID and an admin must approve any apps targeted to their organization.


For more information, please see the Help Center.

Launch Details
Release track:
Available to both Rapid Release and Scheduled Release

Editions:
Available to all G Suite editions

Impact:
All end users

Action:
Change management suggested/FYI

More Information
Help Center: Publish private apps


Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Publish private apps to multiple organizations

Businesses using Google Mobile Management and other Enterprise Mobility Management (EMM) providers can publish Android apps customized for their workplace directly to their managed Google Play store, where their employees can easily access and install them. In some cases, these customers have set up multiple “organizations” within their domain (e.g. to serve different regions, for testing purposes, etc.), each of which needs access to the custom app. To meet this need, we recently made it possible to publish a single private app to up to 20 organizations. This has several advantages:
  1. Developers can publish apps to domains other than their own (including developers with personal @gmail.com accounts).
  2. Developers no longer need to be admins of the organizations they’re publishing to.
  3. Businesses can more easily delegate app publishing to third-party developers.
  4. Private app publishing remains secure, because the developer must have the target organization’s Organization ID and an admin must approve any apps targeted to their organization.


For more information, please see the Help Center.

Launch Details
Release track:
Available to both Rapid Release and Scheduled Release

Editions:
Available to all G Suite editions

Impact:
All end users

Action:
Change management suggested/FYI

More Information
Help Center: Publish private apps


Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Upcoming change to setup flow for company-owned Android devices

As a G Suite admin, you can use Google Mobile Management to manage, secure, and monitor mobile devices in your organization. Additionally, if you provide your employees with devices, you can apply policies that regulate app installation, network settings, security options, and more.

If you have Advanced management enabled, you can set up Android devices* your company owns in one of two ways. (1) You can add devices in the Admin console, automatically assigning their ownership to your organization, or (2) you can allow individual users to assign ownership of their devices to your organization when they set them up. If you choose the second option, those users will see changes to their setup flow starting on February 12th, 2018. (*These devices must be running Android 6.0 or higher.)

Currently, when a user with a brand new Android device (or one that’s recently been factory reset) adds their G Suite account to that device before adding their personal account, they have to check a box to assign device ownership to their organization. (If they add their personal account first, then they’re prompted to set up a work profile when they add their G Suite account later on.) We’ve learned that some users skip checking the box to assign device ownership, even if their phone is company-owned, resulting in a fragmented management experience.

Current setup screen

To encourage more users to make the correct selection, we’re changing the language and option on this screen. Starting on February 12th, 2018, users will be asked if they own the device they’re setting up. Unless they explicitly state that they own the device personally, ownership will be auto-assigned to your organization. Again, this will only occur when a user adds their G Suite account to a device before adding their personal account.

New setup screen

We hope this will result in fewer company-owned devices that are incorrectly set up and an improved mobile management experience.

Launch Details
Release track:
Launching to both Rapid Release and Scheduled Release on February 12th, 2018

Editions:
Available to all G Suite editions

Rollout pace:
Extended rollout (potentially longer than 15 days for feature visibility)

Impact:
All end users

Action:
Change management suggested/FYI

More Information
Help Center: Get started with Google Mobile Management
Help Center: Set up Android devices your company owns


Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Protecting corporate data on non-compliant managed Android devices

The Google Apps Device Policy app enforces your organization’s security policies on employees’ managed Android devices, protecting them and making them safer. If a security policy is violated, it’s especially important to ensure that corporate data isn’t accessible on that device until it’s once again compliant.



With that in mind, the Device Policy app will now disable access to non-critical apps* on any work profile or company-owned Android device that it determines is non-compliant. Users will see a notification informing them that their device violated a security policy and some apps may be disabled. Those apps will be re-enabled when their device complies with all of the organization’s security policies.

*Non-critical apps are any apps that aren’t required for a device to function. For example, Dialer is a critical app, but Gmail is a non-critical app.

Launch Details
Release track:
Launching to both Rapid Release and Scheduled Release

Editions:
Available to all G Suite editions

Rollout pace:
Gradual rollout (up to 15 days for feature visibility)

Impact:
All end users

Action:
Change management suggested/FYI

More Information
Help Center: Protect corporate data on mobile devices
Help Center: Mobile audit log
Help Center: Automate mobile management tasks with rules
Help Center: Use the Google Apps Device Policy app on an Android device
Help Center: Assist users of managed Android devices


Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates

Protect corporate data on compromised iOS devices

Google Mobile Management allows G Suite admins to control access to company data on managed devices directly from the Admin console. With this launch, we’re giving admins increased power to protect their organizations’ data by preventing their users from syncing corporate data on jailbroken iOS devices.

Admins can enable this feature in the Admin console under Device Management > Advanced Settings > Security. Note that this feature is off by default and requires an organization to have Advanced Mobile Management for iOS enabled in order to turn on.


For this setting to work, users need to have the Google Device Policy app installed. Once the feature is turned on, users who don’t have the Device Policy app on their device will be prompted to install it. Once installed, the app will check if the device is jailbroken regularly, and notify the user if they pass or fail that check.


This setting should help G Suite admins and end users keep their organization’s data secure. For more details, visit the Help Center.

Launch Details
Release track:
Launching to both Rapid Release and Scheduled Release

Editions:
Available to all G Suite editions

Rollout pace:
Extended rollout (potentially longer than 15 days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information
Help Center: Apply advanced settings


Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates