Tag Archives: Security and Compliance

Know who an event is shared with when using shared Google Calendars

What’s changing 

Users can have one of the following access permissions for shared Google Calendars: 
  • “See only free/busy (hide details)” 
  • “See all event details” 
  • “Make changes to events” 
  • “Make changes and manage sharing” 
The “Make changes to events” permission enables users to create events on shared calendars, but when those events are created, the user does not know which other users the event is shared with. 

To improve upon experience and ensure users are aware of who they are sharing content with, users with the ability to “Make changes to events” can now see the members of the shared calendar, i.e. who their events are shared with. 

users with the ability to “Make changes to events” can now see the members of the shared calendar, i.e. who their events are shared with.

Getting started 

  • Admins: As an admin, you can control how much calendar information people in your organization can share with users external to your organization. You can also set the default level of sharing for users within your organization. Visit the Help Center to learn more about setting Calendar sharing options. 
  • End users: On Calendars with “make changes to events” access permission, you will now see the members of calendars. You can control the access permission of other users for your Calendars only on Calendars with “make changes and manage sharing” access permissions. Visit the Help Center to learn more about sharing your calendar with someone. 
  • Developers: For Calendars where a user has “make changes to events” (aka “writer”) permissions, the Acl.list and Acl.get method will newly return the members of the shared calendar and Acl.watch will notify about changes to members. 

Rollout pace 


Availability 

  • Available to all Google Workspace customers, Workspace Individual Subscribers, and users with personal Google accounts 

Resources 

Know who an event is shared with when using shared Google Calendars

What’s changing 

Users can have one of the following access permissions for shared Google Calendars: 
  • “See only free/busy (hide details)” 
  • “See all event details” 
  • “Make changes to events” 
  • “Make changes and manage sharing” 
The “Make changes to events” permission enables users to create events on shared calendars, but when those events are created, the user does not know which other users the event is shared with. 

To improve upon experience and ensure users are aware of who they are sharing content with, users with the ability to “Make changes to events” can now see the members of the shared calendar, i.e. who their events are shared with. 

users with the ability to “Make changes to events” can now see the members of the shared calendar, i.e. who their events are shared with.

Getting started 

  • Admins: As an admin, you can control how much calendar information people in your organization can share with users external to your organization. You can also set the default level of sharing for users within your organization. Visit the Help Center to learn more about setting Calendar sharing options. 
  • End users: On Calendars with “make changes to events” access permission, you will now see the members of calendars. You can control the access permission of other users for your Calendars only on Calendars with “make changes and manage sharing” access permissions. Visit the Help Center to learn more about sharing your calendar with someone. 
  • Developers: For Calendars where a user has “make changes to events” (aka “writer”) permissions, the Acl.list and Acl.get method will newly return the members of the shared calendar and Acl.watch will notify about changes to members. 

Rollout pace 


Availability 

  • Available to all Google Workspace customers, Workspace Individual Subscribers, and users with personal Google accounts 

Resources 

Better understand app access with the new Access Evaluation log event

What’s changing 

We’re introducing a new log event, Access Evaluation, which will help admins better understand how security policies affect their users' access to OAuth apps. This includes settings and policies such as API controls, endpoint management configurations, domain wide delegation and more. The log contains information on the specific policies applied, when access was granted and the reasoning. Admins can use this information to review their security policies and revise them as needed to protect the sharing of Workspace data with users' apps.

Example of an Access Evaluation log


Getting started

  • Admins: Access Evaluation are available in the audit and investigation tool (Menu > Reporting > Audit and investigation > Access Evaluation log events), and the security investigation tool (Menu > Security > Security center > Investigation tool > Data source > Access Evaluation log events)  for specific Google Workspace editions. Visit the Help Center to learn more about Access Evaluation log events. 
  • End users: There is no end user impact or action required.

Rollout pace


Availability

  • Available in the audit and investigation tool for all Google Workspace customers.
  • Available in the security investigation tool for Google Workspace:
    • Frontline Standard
    • Enterprise Standard and Plus
    • Education Standard and Plus
    • Enterprise Essentials Plus
    • Cloud Identity Premium

Resources


Prevent the downloading, printing, or copying of files by all users with Enhanced IRM for Google Drive Data-Loss Prevention

What’s changing 

Google Drive’s Information Rights Management (IRM) capability protects documents from data exfiltration actions, specifically downloading, printing, and copying. This is useful for making sure that sensitive content is protected from data leakage. 


Historically, this feature has only been applicable to users with either the “viewer” or “commenter” role, which has left administrators unable to apply the setting to users with either “owner” or “editor” roles. To address this, we’re expanding IRM to be applicable to all users, including file editors and owners, when it is applied by a Data Loss Prevention (DLP) rule.

The new Enhanced IRM action, as seen in the DLP Rule creation flow.



Additional details

When an editor or owner is affected by IRM, they will retain the ability to copy and paste document content, but they may only do so within that document. Attempting to paste content outside of the document will not succeed. For more information, please refer to the help center content.


Getting started

  • Admins: DLP rules and CAA levels are applied per-file based on how these rules are configured.
  • End users: Only administrators can set IRM for all user roles on a file. File owners may still only set IRM for viewers and commenters. If a file has both an administrator-applied IRM setting and a file owner setting on it, the administrator setting takes priority. Once this feature is enabled, all entry points for downloading, printing, and copying will be removed from Google Drive, Docs, Sheets, and Slides on all platforms. Visit the Help Center to learn more about stopping, limiting, or changing how your files are shared.
A view of the file owner’s IRM setting when an overriding administrator setting is present.

Rollout pace


Availability

  • IRM controls are available for all Google Workspace customers
  • Data Loss Prevention Rules and Context-Aware Access conditions are available for Google Workspace:
    • Enterprise Standard and Plus
    • Education Fundamentals, Standard, Plus, and the Teaching and Learning add-on
    • Frontline Standard
    • Enterprise Essentials and Enterprise Essentials Plus

Resources


Control whether your users can add account recovery information with two new admin settings


What’s changing

We’re launching two new settings that will allow admins to control whether their users can add recovery email information and phone information to their Google Workspace account. 

By default, the ability to add a recovery email or phone number is ON for most Workspace users and K-12 super admins, but it should be noted that:

  • Adding email and phone recovery information is OFF by default for K-12 users. 
  • Phone number recovery collection is always enabled for super admins regardless of whether it’s disabled in the admin console.

Any changes admins make to these settings will overrule the existing organizational unit (OU) settings, except for super admins as stated above.

Security > Account Recovery > Recovery information


Who’s impacted

Admins and end users


Why it’s important

Adding recovery information to your account is helpful for keeping users’ accounts more secure, recovering users’ accounts as well as evaluating security related events, such as risky logins or re-authentication attempts. However, we know that there are a variety of reasons that customers would want to prevent their users from doing so. For example, turning recovery information off can help customers stay compliant with local privacy regulations, such as GDPR. Or admins can opt to add recovery information themselves. This update gives admins the control to decide which configuration makes the most sense for their users.

Getting started


Rollout pace


Availability

  • Available to all Google Workspace customers.

Resources


Available in open beta: Set up Single-Sign On with custom OpenID Connect profiles

What’s changing 

Beginning today, admins now have the option to set up a custom OpenID Connect (OIDC) profile for single sign-on (SSO) with Google as their Service Provider. OIDC is a popular method for verifying and authenticating the identities - this update gives admins more options for their end users to access cloud applications using a single set of credentials. Previously, only OIDC with pre-configured Microsoft Entra ID profile was supported in addition to SAML.

Custom OIDC profiles can be configured in the Admin console at >Security > Authentication > SSO with third party IdP



Getting started


Rollout pace


Availability

  • Available for all Google Workspace customers except Google Workspace Essentials Starter customers and Workspace Individual Subscribers.
  • Also available for Cloud Identity and Cloud Identity Premium customers

Resources


Now generally available: the Groups Editor & Groups Reader roles can now be provisioned for specific group types

What’s changing

At the beginning of the year, we launched the ability to assign the Groups Editor and Groups Reader roles for security groups or non-security groups in open beta. Beginning today, this feature is now generally available. Groups Admins have access to all groups. The new roles of Groups Editor and Groups Reader offer delegated admin permissions for groups, and can use conditions to limit access to sensitive groups as needed.

Getting started: 

Available in open beta: prevent sensitive changes by locking Groups

What’s changing

Admins can now label a Google Group as “Locked,” which will heavily restrict changes to group attributes (such as group name & email address) and memberships. This will help admins who sync their groups from an external source and want to prevent getting out of sync, or who want to restrict changes to sensitive groups. This feature will be available in open beta, which means no additional sign-up is required. 

The Group Details page in the Admin console shows a “Locked” label on the group, with the message “You can’t update this group - it might be managed by an external identity system.”


Who’s impacted

Admins

Why it’s important

If you use third-party tools, like Entra ID, to manage group synchronization, you may encounter inconsistencies when modifications are made to these groups, like adding or removing members, for example. To help address this, we’re introducing the option to “lock” a group, which will prevent modifications within Google Workspace and help maintain synchronization with the external source. 

When a group is locked, only certain admins* can modify:

  • The group name, description, email, and alias(es)
  • Group labels
  • Memberships (adding or removing members) and member restrictions
  • Membership roles
  • Delete the group
  • Set up a new membership expiry

When a group is locked, access and content moderation settings are not affected, this includes:

  • Who can post
  • Who can view members
  • Who can contact members
  • Membership removals due to an existing membership expiry
  • Access or content moderation settings

*Super Admins, Group Admins, and Group Editors with a condition that includes “Locked Groups”

Additional details

By default, the changes listed above will be restricted from end users, including group owners and managers of a locked group. If you want to also restrict some admins from making these changes in the Admin Console or APIs, you can assign them the Group Editor role with a condition that excludes locked groups. 

The ability to lock or unlock a group using the “Locked” label is available to Super Admins, Group Admins, or a custom role with the “Manage Locked Label” privilege. Lock a group using the “Locked” group label in the Admin Console, or the Cloud Identity Groups API.


Getting started

Rollout pace

Availability

Available for Google Workspace:
  • Enterprise Standard and Plus
  • Enterprise Essentials Plus
  • Education Standard and Plus
  • Also available to Cloud Identity Premium customers

Resources


HIPAA and additional ISO certifications for the Gemini app on web and mobile

What's changing

We’re pleased to announce the attainment of HIPAA, ISO 27701, 27017, 27018, 9001, and 42001 certifications for the Gemini app on web and mobile. These certifications give customers the peace of mind that data (including personally identifiable, financial and medical information) submitted to or generated by the Gemini app will be handled in accordance with recognized security controls and privacy frameworks.

With these certifications, Gemini for Workspace and the Gemini app each have a comprehensive set of safety, privacy and security certifications internationally recognized by regulatory and compliance bodies.

The achievement of ISO 42001, the world's first international standard for Artificial Intelligence Management Systems (AIMS), certifies that Gemini has been developed, deployed, and maintained responsibly with appropriate ethical considerations, data governance, and transparency. To date, no other generative AI offering for productivity and collaboration has met this level of recognition, showing that Gemini is the first in the industry ready to support businesses and public sector organizations while benefiting all users.





Additional details



Getting started

Rollout pace

  • Available now

Availability

Available for Google Workspace customers with these add-ons:
  • Gemini Business
  • Gemini Enterprise
  • Gemini Education
  • Gemini Education Premium

Available for Google Workspace customers accessing the Gemini app as a core service with these editions:
  • Business Starter, Business Standard, Business Plus
  • Enterprise Starter, Enterprise Standard, Enterprise Plus
  • Frontline Starter, Frontline Standard
  • Essentials, Enterprise Essentials, Enterprise Essentials Plus
  • Google Workspace for Nonprofits
  • Education Standard, Education Plus

Adding granular control options for who can respond to Google Forms

What’s changing

Last year, we ​​introduced a beta that gives Google Forms creators more granular control over who can respond to their forms via sharing settings. 

Previously, form creators had two sharing options: restrict responses to users within their domain (and trusted domains) or make forms public (i.e. anyone with the URL can respond). 

With this new option, now generally available, form creators can limit response access to specific users, groups, or target audiences—similar to how file owners can restrict the sharing of Google Docs, Sheets, Slides or Sites in Drive. 

Adding granular control options for who can respond to Google Forms




Who’s impacted 

Admins, end users and developers 


Why you’d use it 

This feature is useful in any scenario where you’d like to control who can respond to a form. For example, business leaders can better collect feedback from specific organizational units and prevent the form from being responded to by other teams or organization units. Similarly, teachers can use this to ensure a quiz is only accessible to select students who receive the link.


Getting started 

  • Admins: There is no admin control for this feature. 
  • End users: 
    • Form creators must publish their form to enable responders to view the form or submit a response. 
    • Form creators can see who has access to the form and share response access to specific users, groups, or target audiences. 
    • Visit the Help Center to learn more about publishing & sharing your form with responders.

Rollout pace 


Availability 

  • Available to all Google Workspace customers and users with personal Google Accounts 
    • Note: The target audiences feature mentioned above is only available for the Google Drive and Docs and Google Chat services. Supported editions for this feature on Drive, Docs & Chat include: Business Plus, Enterprise Standard, Enterprise Plus, Education Standard, Education Plus, Enterprise Essentials and Enterprise Essentials Plus. Supported editions for this feature on Drive & Docs only include: Business Standard, Nonprofits and G Suite Business. 

Resources