Try to do the same for Azure Ad + intune + office 365 + ... Hundreds of pages....
A practical guide to securing Google Workspace for a startup
21–30 of 64 posts
Re: A practical guide to securing Google Workspace for a startup
#22Another tip - enabled Advanced Protection Program. You can't enforce this at the GSuite level but for a small company it's easy to just audit for it. We have everyone do this as part of onboarding and we audit once a month.
One hundred percent agreed. Not sure why Google doesn't allow enforcement of this for Workspace accounts.
This is a great guide, I just wish Google made it easier to be "secure by default". It's very difficult to know all the various toggles you need to have switched on to be secure.
Re: A practical guide to securing Google Workspace for a startup
#23Try to do the same for Azure Ad + intune + office 365 + ... Hundreds of pages....
Haha.. I tried a bit and failed to get it to hang together with some poking.
One user request was to STOP the "windows hello" PIN requirement, and just have a password (+ MFA) for login. Does anyone know how to do this with either standard Office 365 subscriptions, or office 365 + Intune or similar? Would love not to have to do Azure AD outside of the office subscriptions. Microsoft has a fair number of SKU's these days that kind of overlap (and get renamed).
Re: A practical guide to securing Google Workspace for a startup
#24This article covers Macs as well. I wonder about Windows.
Hi! We will eventually cover other OSes. In the meantime, for Windows, Microsoft has good guides through they are usually very lengthy - https://techcommunity.microsoft.com/t5/microsoft-security-ba...
Re: A practical guide to securing Google Workspace for a startup
#25This is super helpful. Passing over to the orgs using Workspace in my world.
Re: A practical guide to securing Google Workspace for a startup
#26I wish it had a feature in the admin section where one could disable different 2FA methods. For example, in my family everyone has SMS as a 2FA, as well as hardware tokens and device prompts. SMS was there from the beginning, so everyone has it activated. Only one account is not using hardware tokens.
So what I'd like to do is to set SMS to off, and all the accounts which already have something like device prompts and/or at least one hardware token added, get SMS deactivated without user intervention.
Re: A practical guide to securing Google Workspace for a startup
#27I wish it had a feature in the admin section where one could disable different 2FA methods. For example, in my family everyone has SMS as a 2FA, as well as hardware tokens and device prompts. SMS was there from the beginning, so everyone has it activated. Only one account is not using hardware tokens. So what I'd like to do is to set SMS to off, and all the accounts which already have something like device prompts an…
There is, though it is not ultra granular. They introduced it last year and we mention it in the guide.
https://workspaceupdates.googleblog.com/2019/03/more-control...
Essentially you can enforce 2FA or not, then, you can allow ANY method, any method BUT telephony based (calls and SMS), or hardware security key only.
The middle option for most people is a great one as it allows Google Prompt (push notifications) as well as Google Authenticator style OTPs, plus security keys.
Re: A practical guide to securing Google Workspace for a startup
#28I wish it had a feature in the admin section where one could disable different 2FA methods. For example, in my family everyone has SMS as a 2FA, as well as hardware tokens and device prompts. SMS was there from the beginning, so everyone has it activated. Only one account is not using hardware tokens. So what I'd like to do is to set SMS to off, and all the accounts which already have something like device prompts an…
There is, though it is not ultra granular. They introduced it last year and we mention it in the guide. https://workspaceupdates.googleblog.com/2019/03/more-control... Essentially you can enforce 2FA or not, then, you can allow ANY method, any method BUT telephony based (calls and SMS), or hardware security key only. The middle option for most people is a great one as it allows Google Prompt (push notifications) as w…
Good to know, thanks! It's exactly what I need.
Re: A practical guide to securing Google Workspace for a startup
#29FYI to setup an alert like "Out of domain email forwarding" -- you have to go to Reporting > Login. If you go to Rules and click "create rule" it'll take you to Reporting > Admin, which won't have the Login event types.
Re: A practical guide to securing Google Workspace for a startup
#30Nice guide. I would also suggest checking your domain's MX records to ensure you have things configured correctly including DKIM etc. Google has this tool that gives your domain a scan: https://toolbox.googleapps.com/apps/checkmx/
Just wanted you to know that this made a huge difference on my most important domain, today. I appreciate your pointing it out because I assumed Gmail would automagically handle everything