implementing-google-workspace-admin-security

# Implementing Google Workspace Admin Security ## When to Use - Deploying or hardening a Google Workspace environment for enterprise use - CIS benchmark compliance assessment for Google Workspace configuration - Protecting against business email compromise (BEC) and phishing attacks targeting Google accounts - Implementing Data Loss Prevention controls for Gmail and Google Drive - Restricting OAuth application access and third-party integrations - Configuring admin account security with Advanced Protection Program enrollment **Do not use** for Microsoft 365 environments; Google Workspace has distinct admin console settings and API configurations that differ from Azure AD/Entra ID controls. ## Prerequisites - Google Workspace Business Plus, Enterprise Standard, or Enterprise Plus license - Super Admin access to the Google Admin Console (admin.google.com) - DNS management access for SPF, DKIM, and DMARC record configuration - Google Cloud Identity or Cloud Identity Premium for advanced security features - FIDO2 security keys for super admin accounts (YubiKey 5 Series recommended) ## Workflow ### Step 1: Harden Super Admin Accounts Secure the highest-privilege accounts in the Google Workspace tenant: ```bash # Google Workspace Admin SDK - configure admin account security # Using gam (Google Apps Manager) CLI tool # List all super admin accounts for audit gam print admins role "Super Admin" > super_admins.csv echo "Review and minimize super admin count (recommended: 2-3...