Google Workspace Security Audit: 12 Settings to Check

A 20-person engineering consultancy in Ottawa moved to Google Workspace in 2016. One of the partners set it up over a weekend, and after that nobody opened the Admin console except to add new hires. Ten years later, two former co-op students still hold super admin rights, half the project folders in Drive are shared with "anyone with the link," and no one can say which apps have access to the partners' inboxes.

This is a common story. Google Workspace is built for collaboration first, so its defaults favour sharing over lockdown. Google secures its data centres and cloud infrastructure; how your tenant is configured is your responsibility.

A Google Workspace security audit goes through those settings one by one, compares them with Google's own recommendations, and prioritizes what actually matters. Here is where our team looks first.

Why an audit and not just a quick look

According to a 2025 Coalition study, 77% of Canadian small businesses believe they are too small to be targeted, yet 86% had experienced a cyber security event in the last five years. For a business that runs on Google Workspace, the Admin console is often the only real security system: it controls identity, email, files and part of your device fleet.

The problem isn't the platform. It's drift. Every new hire, every app connected "just to try it," every folder shared with a client adds an exception. An audit resets the baseline and documents the configuration you actually want.

If your organization runs on Microsoft instead, see our Microsoft 365 security audit article. The logic is the same; the settings differ.

Admin accounts: the keys to the kingdom

A super admin can do anything: read mail, reset passwords, switch off protections. That makes these accounts an attacker's first target.

What we check:

• How many super admins you have. Google recommends more than one, each managed by a different person, so you never get locked out. Beyond two or three, though, every extra account is unnecessary risk.
• Separation of duties. The super admin account is used for admin tasks only, then signed out. Day to day, the same person works from a regular account, with a narrower delegated role if needed (user management, for example).
• Recovery information. Up-to-date recovery phone and email, plus backup codes printed and stored somewhere safe.
• Domain access. Credentials for your DNS registrar are stored securely. Google may need proof of domain ownership to help you recover the account.

Identity: 2-Step Verification and legacy access

2-Step Verification (2SV) is the highest-value setting in the whole audit. The goal is to enforce it for all users, not just allow it.

Not all methods are equal. SMS codes can still be phished or hijacked through SIM swapping, while security keys and passkeys are far more resistant. For super admins and executives, aim for a hardware key. Our guide to choosing your MFA compares the options.

On legacy access, there is good news: Google turned off "less secure apps" access for all accounts on March 14, 2025. IMAP, POP, SMTP, CalDAV and CardDAV no longer accept a plain account password. The one exception is app passwords. The audit checks who still has them, what they are for (an old scanner that emails PDFs, for instance) and whether an OAuth connection can replace them.

Finally, cap session length. An account left signed in for months on the shared reception computer is an open door.

Gmail: spoofing, phishing and auto-forwarding

Email is still the main way attackers get in. In Gmail, three groups of settings deserve your attention.

Domain authentication. SPF, DKIM and DMARC stop fraudsters from sending messages that appear to come from your domain. Since February 1, 2024, Google has required SPF or DKIM from everyone sending to Gmail accounts, and all three from senders of more than 5,000 messages a day. If those acronyms mean nothing to you yet, read SPF, DKIM and DMARC explained.

Anti-phishing protections. Enhanced pre-delivery message scanning, plus the extra checks on attachments, links and external images, should be turned on. In tenants configured years ago, they are often partial or off entirely.

Automatic forwarding. A rule that quietly copies the controller's mail to an outside address is a classic sign of business email compromise. Unless there is a specific business need, disable automatic forwarding to external addresses and keep an eye on the related alerts.

Drive, Calendar and third-party apps

For an architecture firm in Kingston, drawings are intellectual property. Yet in many tenants a new file can be shared by link in two clicks, with no warning at all.

Settings to review:

• Link sharing for new files: off, so only the creator can open a file until they deliberately share it.
• External sharing warnings: users must confirm before sharing outside the organization. For sensitive data, block external sharing for that organizational unit.
• Calendar: externally, share free/busy information only, not meeting details.

Third-party apps are the most common blind spot. Every time someone clicks "Sign in with Google" on an e-signature or note-taking tool, they may grant it access to their mail or Drive. In the Admin console's API controls, build an inventory, remove what is no longer used and restrict unapproved apps from sensitive services.

The Google Workspace audit checklist

This is the grid our team starts from. Exact console paths vary slightly by edition.

Add two process checks. First, your offboarding routine: suspend the account, transfer files, revoke access tokens. Second, who watches the alert centre. A perfect configuration is useless if nobody reads the alerts.

How an audit with our team works

We work in three stages. First, a short interview to understand how you work: who shares what with whom, which tools are connected to Google, and which data counts as personal information under Québec's Law 25 or federal privacy law. Next, a technical review of the console, setting by setting. Finally, a prioritized report that separates urgent fixes, changes that need a heads-up to staff, and items that can wait.

The point isn't to lock everything down overnight. Cutting off external sharing without warning at a firm that collaborates with 40 clients is a guaranteed Monday-morning revolt. So we plan the changes with you, in waves.

Learn more about the engagement on our Microsoft 365 and Google Workspace audit page.