The Google Workspace admin settings worth turning on this week

The short answer

The most important Google Workspace security best practices for a small business are: enforce 2-step verification for everyone, starting with admins; protect and limit super admin accounts; turn off public link sharing and warn on external sharing; turn on Gmail’s advanced phishing and malware protections; set up SPF, DKIM and DMARC for your domain; control which third-party apps can access company data; and make sure someone reads the alert center.

Google publishes a security checklist for businesses with 1 to 100 users and a longer one for 100 or more. This guide follows those checklists, adds the settings we see missed most often, and puts them in the order to roll them out with the least disruption. Menu names are as of 2026 and Google does move things, so search the admin console if a setting has shifted.

Some features, such as Google Vault, advanced device management and certain security dashboards, depend on your Workspace edition. Business Starter includes fewer controls than Business Standard, Business Plus or Enterprise, so check your edition before planning a rollout.

1. Lock down admin accounts first

A compromised super admin account can do anything in your domain, so start here.

• Have more than one super admin, each managed by a separate person, so you are never locked out, as Google’s checklist recommends. Keep the number small, usually two.
• Give super admins separate accounts used only for administration, not daily email.
• Add recovery phone and email details to admin accounts, and generate backup codes in advance.
• Do not leave super admin accounts signed in when they are not needed.
• Use delegated admin roles, such as user management or help desk admin, for routine tasks.
• Require security keys or passkeys for admins where possible.

2. Enforce 2-step verification for everyone

Google’s small business checklist calls for 2-step verification for admins and key users and recommends it for everyone, especially anyone handling financial or employee records. Roll it out in stages so nobody is locked out:

1. In the admin console, go to Security, then Authentication, then 2-step verification, and allow users to turn it on.
2. Tell staff why and how, and give them one to two weeks to enroll, using the authenticator app or a security key.
3. Set a new-user enrollment period so new hires have time to set it up.
4. Turn on enforcement, organizational unit by organizational unit, starting with admins and finance.
5. Where possible, restrict methods to security keys, passkeys or prompts, rather than text messages, which are easier to intercept.

Have a process for lost phones: an admin can generate backup codes for a verified user.

3. Control file sharing

Drive sharing is where most accidental data exposure happens in Workspace.

• Turn off the option for users to make files public on the web unless you have a specific need.
• Set the default for new files so only the creator can see them, as Google’s small business checklist suggests, or limit link sharing to people in your organization.
• Warn users when they share files with people outside your company.
• Consider allowlisting trusted partner domains instead of allowing sharing with anyone.
• Use shared drives for team files, so documents stay with the business when someone leaves.
• Limit external calendar sharing to free/busy information only.

4. Strengthen Gmail protection

• Turn on enhanced pre-delivery message scanning.
• Turn on the advanced phishing and malware protection settings, including protection against spoofing of your domain and of employee names.
• Turn on additional screening for malicious attachments and links.
• Set up SPF, DKIM and DMARC for your domain, so other servers can tell your real mail from forgeries. Start DMARC in monitoring mode, review the reports, then move to quarantine or reject.
• Disable automatic forwarding to external addresses, or alert on it. Attackers who take over a mailbox often set up forwarding rules to watch for invoices.

Want to know which of these are already on in your domain? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, integration, automation, AI opportunities, technology spending and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

5. Control third-party app access

Staff can connect apps to their Google accounts with a single click, sometimes granting access to all of their mail and files. In the admin console, review the list of apps that have accessed your data, mark trusted apps you rely on, and restrict or block the rest from high-risk services such as Gmail and Drive. Review the list every quarter.

6. Manage devices

• Turn on basic mobile management so you can require a screen lock and remotely sign out or wipe company data from a lost phone.
• Require company-owned laptops to be encrypted, updated and protected with endpoint security.
• Set automatic updates for Chrome and other apps and browsers, as Google’s checklist recommends.
• Review the device list regularly and remove devices from former employees.

7. Watch the alert center

Google Workspace generates alerts for suspicious sign-ins, government-backed attack warnings, leaked passwords, suspicious forwarding and changes to admin settings. They are only useful if someone reads them.

• Set email notifications for high-severity alerts to at least two people.
• Agree on what happens when an alert fires: who checks it, and when to reset a password or suspend an account.
• Check the security dashboard and audit logs monthly for unusual activity, such as mass downloads or new admin role assignments.

8. Offboard leavers the same day

• Suspend the account or reset the password and sign-in cookies on the employee’s last day.
• Transfer Drive files to a manager or shared drive before deleting the account.
• Revoke app passwords, third-party app tokens and mobile device access.
• Remove them from groups, shared drives and calendar delegation.
• Keep data under your retention policy, using Google Vault where your edition includes it.

Do the same for accounts in every other system the person used, such as payroll, CRM and banking.

Roll-out order

1. Week 1: secure admin accounts, add a backup super admin and generate backup codes.
2. Week 1: turn on Gmail advanced protections and check SPF and DKIM.
3. Weeks 1 to 3: announce 2-step verification, let staff enroll, then enforce.
4. Week 3: tighten sharing defaults and turn on external sharing warnings.
5. Week 4: review third-party apps, set up alerts and start DMARC monitoring.
6. Monthly: review alerts and audit logs. Quarterly: review apps, admins and sharing.

If you are still deciding between platforms, see our Microsoft 365 vs Google Workspace comparison. JLB USA administers Google Workspace as part of our managed IT service and our cybersecurity services cover MFA, access reviews, email security and same-day removal of leavers for businesses with roughly 25 to 100 employees.

Keep reading

• How much does cybersecurity cost for a small business in 2026?
• Cybersecurity checklist for small business: 30 items in priority order
• Remote work security best practices for small and midsize businesses
• Microsoft 365 security settings every small business should check in 2026

Related services

• Cybersecurity services
• Managed IT services
• Microsoft 365 vs Google Workspace