We are updating the administrative privileges setting for Windows device management to give administrators more control over how local administrative access is handled on Windows 10 and Windows 11 devices, managed by Google Endpoint Management.

This update simplifies settings and provides greater flexibility for organizations that need to preserve local admin access while managing specific users via Google Workspace. Previously, managing local administrative access used a "Replace" behavior, which removed any existing members from the local administrators group before adding the newly requested ones.

Getting started

Rollout pace

Availability

Resources

What’s changing 

The Shared Signals Framework (SSF) is a community supported initiative of the OpenID Foundation, focused on developing and maintaining a standardized protocol for cross-system communication between security platforms to share security insights and events. To support the SSF initiative, Google Workspace is implementing a SSF Receiver to ingest Continuous Access Evaluation Profile (CAEP) signals. This feature is available in closed beta for Google Workspace customers and interested partners. Eligible customers and security platform providers can use this form to express interest in the closed beta. 

Who’s impacted 

Admins 

Why it matters 

Our closed beta of the Shared Signals Framework (SSF) offers an example use case: session revocation. When Google Workspace gets a signal to revoke a session, the user's session is automatically invalidated, which cuts down the time a potentially compromised user has system access. This highlights SSF's strength: enhancing security by improving cross-system communication and speeding up responses to security events. 

Getting started 

Availability 

Available for Google Workspace: 

What’s changing 

Admins can now apply Context-Aware Access (CAA) policies to apps which use OpenID Connect (OIDC), which are a subset of OAuth apps that are authenticated using Google sign-in. Admins can use a single setting to apply CAA policies to all OIDC apps by default. We are not providing per app access control for individual apps at this moment. The new OIDC setting can also be applied in monitor mode for admins to gauge potential end user impact before applying in active mode. 

CAA creates granular access control security policies for apps based on attributes, such as user identity, location, device security status, and IP address, and they can be applied to users on personal and managed devices. Expanding CAA to encompass OIDC apps means admins can ensure their users are able to access or are blocked from accessing these apps according to the broader security parameters of their organizations. 

Admins can configure CAA policies for OIDC apps in the Admin console under Security > Context-Aware Access > General settings 

Getting started 

Rollout pace 

Availability 

Available for Google Workspace: 

Resources 

What’s changing 

Admins can now select “Warn” as an action when deploying context-aware access (CAA) levels. When applied, end users will see a warning message if they do not meet their admin defined conditions for accessing Google Workspace applications. They can click “See details” to see more information about why they received the warning – for example, they may be notified that their operating system is outdated and requires an update. The warning provides a useful reminder for the user to take action otherwise access could be blocked in the future. 

It’s important to note that “Warn” mode will not block users from accessing a particular app or service and they will have the option to proceed despite the warning. “Warn” mode helps educate users if they’re trying to access apps in a less secure situation and how to remediate this risk, while reducing the workload required by admins to socialize best practices. 

Example of a warning notification 

Example of what a user might see when they click “See details” 

Additional details 

Getting started 

Admin app access level assignment flow

Rollout pace 

Availability 

Available for Google Workspace: 

Resources 

What’s changing 

All devices with the Google Apps Device Policy will lose access during March 2023 if they have not already upgraded. Existing Google Apps Device Policy app users must switch to Android Device Policy before then to continue syncing work data. Note that, per our last update, the new user registration flow on the legacy Google Apps Device Policy will be blocked and users may see errors during the registration process as of January 2022. Admins can act directly from the alert in the Admin console to identify users who need to upgrade.

Getting started 

New updates

Unless otherwise indicated, the features below are fully launched or in the process of rolling out (rollouts should take no more than 15 business days to complete), launching to both Rapid and Scheduled Release at the same time (if not, each stage of rollout should take no more than 15 business days to complete), and available to all Google Workspace and G Suite customers. 

What’s changing 

We’re introducing stronger safeguards for sensitive actions taken in your Google Workspace account. These apply to actions that, when done by hijackers, can have far reaching consequences for the account owner or the organization it belongs to. 

Google will evaluate the session attempting the action, and if it’s deemed risky, it will be challenged with a “Verify it’s You” prompt. Through a second and trusted factor, such as a 2-step verification code, users can confirm the validity of the action. For example, if a malicious actor gains access to your account and attempts to change the name on your account, the action will be blocked until the true account owner can verify that this was intentional. 

Note that this feature only supports users that use Google as their identity provider and actions taken within Google products. SAML users are not supported at this time. See below for more information. 

Who’s impacted 

Admins and end users 

Why it matters 

This added layer of security helps to intercept bad actors who have gained access to a user's account, further protecting their data and your organization's sensitive information. Additionally, these challenge attempts will be logged as an audit event allowing for further admin investigation. 

Additional details 

In the Admin console under Users > “UserName” > Security, admins can toggle login challenges OFF for ten minutes if a user gets stuck behind a "verify it's you prompt". We strongly recommend only using this option if contact with the user is credibly established, such as via a video call. 

Getting started 

Rollout pace 

Availability 

Resources 

What’s changing 

We’re introducing new API functionality which allows you to automate the process of finding conflicting accounts and inviting them to join your organization. 

Who’s impacted 

Admins, end users, and developers 

Why you’d use it 

When employees create a Google account using one of your organization’s domains to access Google services, this is known as an unmanaged account. Unmanaged accounts are not ideal for managing users and keeping their work data secure. 

Additionally, should an admin try to create a managed account with the same name, this conflict will prevent a managed account from being created. Using the UserInvitation API functionality, you can send a request to convert their personal account to a Google Workspace account. 

While the same action can be manually performed with the Transfer Tool, the API allows unmanaged accounts to be identified and remediated programmatically, using logic that best suits your needs.

Getting started 

Rollout pace 

Availability 

Resources 

New updates 

Unless otherwise indicated, the features below are fully launched or in the process of rolling out (rollouts should take no more than 15 business days to complete), launching to both Rapid and Scheduled Release at the same time (if not, each stage of rollout should take no more than 15 business days to complete), and available to all legacy Google Workspace and G Suite customers. 

Find and insert GIFs faster on Google Chat on iOS Devices 

You can now easily browse, select and insert GIFs while using the Chat iOS mobile app. When enabled by your admin, select the “GIF” icon in the Google Chat compose bar. We hope this makes it easier for you to express yourself when interacting with your colleagues. | Learn more. 

Set a custom duration for "Do Not Disturb" in Google Chat on web and iOS devices 

You can now set the duration of your "Do Not Disturb" status to a specific date and time. We hope this feature gives you the flexibility to mute notifications the way it best suits you. This feature is now available on web, Android and iOS devices. | Learn more. 

Previous announcements 

The announcements below were published on the Workspace Updates blog earlier this week. Please refer to the original blog posts for complete details.

New admin controls for access to discoverable spaces in Google Chat 

We’ve added the ability for Admins to set the default for newly created spaces and enable sharing scoped to specific audiences. | Available to Google Workspace Business Plus, Enterprise Standard, Enterprise Plus, Education Plus, and Education Standard customers only. | Learn more. 

Context-Aware Access remediator provides more context for access denials 

Admins using Context-Aware Access can now provide more information to end users when their access is blocked using the user remediation feature. | Available to Google Workspace Enterprise Plus, Education Plus, and Cloud Identity Premium customers only. | Learn more.

Mark your important tasks with a star in Google Tasks 

You can now mark important tasks with a star in Google Tasks. Additionally, you’ll be able to view or sort your starred items across various tasks lists in the new starred view. | Learn more. 

What’s changing 

Admins using Context-Aware Access can now provide more information to end users when their access is blocked using the user remediation feature. This feature will help end users quickly understand what steps they need to take to re-access Google Workspace. 

Who’s impacted 

Admins and end users 

Why it’s important 

Context-Aware Access allows admins to assign granular access control policies to apps based on attributes such as user identity, location, device security status, IP address, etc. When a user or device does not meet the requirements, they will be unable to access the respective apps. 

Currently, the only course of action for end users is to contact their admin for further support, which causes unnecessary delay, churn, and support calls. End user remediation will enable admins to provide their users with details about why their access has been denied and what steps need to be taken to restore access. 

Further, once an admin enables remediation, they’ll see a message in the Admin console noting whether remediation is enabled. Each remediation action corresponds to an attribute which is causing access to be denied. Visit the Help Center for a list of the possible remediation actions that may be shown to end users. 

Getting Started 

Availability 

Resources 

Quick launch summary 

We’re adding the ability for admins to configure and send group membership information as part of SAML responses. 

Currently, you are able to configure SSO to send user attributes in the SAML response when a user logs in to an app using SAML SSO. With this launch, admins can configure SSO to send group membership information to the application. Apps can then use these attributes to assess user authorization and to implement other business logic. 

Getting started 

Rollout pace 

Availability 

Resources 

New updates 

Unless otherwise indicated, the features below are fully launched or in the process of rolling out (rollouts should take no more than 15 business days to complete), launching to both Rapid and Scheduled Release at the same time (if not, each stage of rollout should take no more than 15 business days to complete), and available to all legacy Google Workspace and G Suite customers. 

New idle status in Google Chat 

In Google Chat on web and Chat in Gmail, you'll see an orange clock badge for users that were recently active in Chat, but aren't currently active. We hope this makes it easier to determine the best time to connect with your colleagues. Visit the Help Center to learn more about availability statuses in Google Chat. 

Changes to the default Host Management controls in Google Meet for users with personal accounts 

The default setting for Host Management controls is changing for users with personal Google accounts. Previously, Host Management controls were ON by default — going forward, this setting will be OFF by default for new meetings. There are no changes to the behavior for Google Workspace customers or Google Workspace Individual users.

What’s changing 

For over a decade, we have given admins the ability to configure authentication through a third-party identity provider . In 2021, we expanded this capability by making it possible to choose between third-party identity provider or Google authentication for specific groups or organizational units (OUs). 

Now, you can further customize authentication by setting up single sign-on (SSO) profiles for multiple identity providers and then configuring authentication for each group or OU. This feature is available beginning today as an open beta, which means you can use it without enrolling in a specific beta program.

You can now set up SSO profiles for multiple third-party identity providers

Go to the Security settings to set up SSO profiles for third-party identity providers

New updates 

Unless otherwise indicated, the features below are fully launched or in the process of rolling out (rollouts should take no more than 15 business days to complete), launching to both Rapid and Scheduled Release at the same time (if not, each stage of rollout should take no more than 15 business days to complete), and available to all Google Workspace and G Suite customers. 

PPTX file limit increase in Google Slides 

You can now import PPTX files up to 300MB into Google Slides using Office Editing mode — previously, 100MB was the maximum. Once imported, you can save back your edits to the underlying PPTX file. | Available to all Google Workspace customers and users with personal Google accounts. | Learn more.

Previous announcements 

The announcements below were published on the Workspace Updates blog earlier this week. Please refer to the original blog posts for complete details. 

Use a new enterprise certificate condition to set context-aware access rules for company-managed devices 

When configuring context-aware access rules, you can now use a new signal to determine whether a device is company-owned. | Available to Google Workspace Enterprise Standard, Enterprise Plus, Education Standard, Education Plus, and Cloud Identity Premium customers. | Learn more. 

Quick launch summary 

When configuring context-aware access rules, you can now use a new signal to determine whether a device is company-owned. By using new enterprise certificates as an alternative context-aware signal to determine if a device is a company-managed asset, you can set more specific context-aware policies that are appropriate based on the trustworthiness of the device. 

The Admin console screen to configure context-aware access rules using enterprise certificate condition

Getting started 

Availability 

Resources 

What’s changing 

Google Groups are a convenient way for Workspaces users to collaborate and a powerful tool for admins to apply consistent security and access policies to sets of users or devices. Dynamic groups further enhance this functionality by allowing group membership to be automatically updated based on parameters such as location, department, or job title. 

Today we are further extending the functionality of dynamic groups in two important ways: 

Who’s impacted 

Admins only 

Why you’d use it 

Dynamic groups can be used for email distribution lists, access control, group based policy, and more. Compared to regular Google Groups they have the added benefit that memberships are automatically kept up-to-date. Automating membership management increases security, reduces errors, and alleviates user frustration while minimizing the burden on admins. 

These new features expand the utility of dynamic groups for organizations that take advantage of custom user attributes and organizational units. They can further tailor dynamic groups to meet the specific needs of their organization. For example these organizations could now: 

Getting started 

Rollout pace 

Availability 

Resources 

Quick launch summary 

With this launch, you can use Google Workspace Admin SDK Directory API to customize a per user language preference via the user create/update flow. 

Previously, the AdminSDK only allowed one customer level language setting that applied to all users, which could then be changed individually via the Admin console, or by the user. We hope this will make it easier to set up and manage your users at scale. 

Getting started 

Rollout pace 

Availability 

Resources 

What’s changing

Earlier this year, we announced a beta for assigning SSO profiles to organizational units or groups. This feature is now generally available and allows admins to specify groups or organizational units (OUs) to authenticate a subset of your users using Google.

Who’s impacted

Admins

Why it’s important

Currently, when you configure SSO with a third-party identity provider, the setting applies to your entire domain. However, there are some instances where you may want a subset of your users, such as vendors or contractors, to authenticate with Google instead. The Partial SSO feature gives you the flexibility to specify the authentication method for various users in your organization as needed.

Quick Summary 

In 2019, we announced a beta that allows Google Workspace, Google Cloud Platform (GCP), and Cloud Identity admins to set a fixed session duration for specific apps and services. This is now generally available. After the session expires, users will need to re-enter their login credentials to continue to access: 

Giving admins more control over how often users need to re-authenticate makes it more difficult for the wrong people to obtain that data if they gain unauthorized access to a device. 

What’s changing 

Currently, you can configure to authenticate your users using a third-party identity provider — this configuration applies to all users within your domain. Now, you have the option to specify groups or organizational units (OUs) to authenticate a subset of your users using Google. This feature is available beginning today as an open beta, which means you can use it without enrolling in a specific beta program. 

Who’s impacted 

Admins 

Why you’d use it 

Currently, when you configure SSO with a third-party identity provider, the setting applies to your entire domain. However, there are some instances where you may want a subset of your users, such as vendors or contractors, to authenticate with Google instead. The Partial SSO beta gives you the flexibility to specify the authentication method for various users in your organization as needed.