Google Workspace is well-designed and reasonably secure out of the box. The defaults are good enough that most teams set it up, move on, and never look at the admin console again.
The problem is that ‘good enough out of the box’ is not the same as ‘configured for a remote team handling client data.’ There are settings that are off by default, features that require manual activation, and audit gaps that only become visible when something goes wrong.
Here are the seven most commonly missed security settings, based on the Workspace audits I run with new clients.
1. 2-Step Verification Is Not Enforced by Default
Google allows users to enable 2-Step Verification (2FA) voluntarily. It does not enforce it by default. In most organisations, this means some users have it enabled and others don’t — and the ones who don’t are your security weak points.
Fix: In the Admin Console, go to Security → Authentication → 2-Step Verification. Set enforcement to ‘On’ for all users. Set the grace period to 1–3 days for existing users. Consider requiring hardware security keys (Google Titan or YubiKey) for admin accounts.
2. External Sharing Is Too Permissive
By default, Google Drive allows users to share files externally with anyone who has the link. For a remote team working with client data, this is an uncontrolled data egress channel.
Fix: Go to Apps → Google Workspace → Drive and Docs → Sharing settings. Set default link sharing to ‘Off’ or restrict external sharing to specific trusted domains. This does not prevent intentional sharing — it just removes the accidental ‘anyone with the link’ exposure.
3. Admin Accounts Are Used for Daily Work
Many Google Workspace admins use their admin account as their primary account. This means every email they read, every link they click, every phishing attempt that lands in their inbox — happens in an account with full admin privileges over the entire organisation.
Fix: Create a separate admin account (e.g., admin@company.com) used only for admin tasks. The admin’s day-to-day account should be a standard user account with no elevated privileges.
4. Login Challenges Are Not Configured
Google can challenge logins from unfamiliar devices or locations. This is a useful layer of protection against account takeover — but the sensitivity settings are often left at default.
Fix: Security → Authentication → Login challenges. Review the settings for employee trust levels and consider enabling ‘Require additional verification for risky logins.’
5. Third-Party App Access Is Unreviewed
Users can grant third-party apps access to their Google account data — calendar, email, Drive — by clicking ‘Allow’ on an OAuth consent screen. Most organisations have dozens of these authorisations sitting unreviewed, some granted by people who have since left the company.
Fix: Security → API controls → Manage third-party app access. Review all connected apps. Revoke access to anything unrecognised or no longer in use. Consider restricting OAuth access to a whitelist of approved apps.
6. Alert Policies Are Not Set Up
Google Workspace includes an alert centre that notifies admins of suspicious activity — mass email deletion, account hijacking attempts, unusual login locations. Most teams have never visited the alert centre and have no notifications configured.
Fix: Security → Alert centre → Alert settings. Enable notifications for: suspicious login activity, account suspension, data export, government-backed attacks. Route alerts to at least two admin email addresses.
7. Offboarded Users Are Deleted Instead of Suspended
When someone leaves, the instinct is to delete their Google account immediately. The problem: deletion removes access to their emails, Drive files, and calendar data — which often contain information the company still needs. Files owned by a deleted user become orphaned.
Fix: When offboarding, suspend the account rather than delete it. Transfer ownership of their Drive files to their manager. Set an out-of-office auto-reply. Archive emails. Only delete the account after a 30-day retention period, and only after confirming all critical data has been transferred.
A Note on Workspace vs. Security Tooling
Fixing these settings is necessary but not sufficient for a fully secured remote team. Google Workspace security is one layer. Device management, identity governance, and documented policies are the others. A well-configured Workspace admin console running on unmanaged laptops with no MDM is still a significant risk — the endpoint is often the weakest link.
For a full view of your remote team’s IT security posture — including identity, devices, and policies — run a free assessment at itops.zlefterov.com
Takes 15 minutes and gives you a prioritised action list.