← All guides
5 min read
The practical Google Workspace security checklist
How to lock down Google Admin Console: Super Admin limits, 2-Step Verification with security keys, external Drive sharing, and API controls.
Keep Super Admins between 2 and 4 dedicated accounts
Google Workspace Super Admins bypass almost every organizational control and can access all Google Drive files and Gmail mailboxes. Never use a Super Admin account for daily email and web browsing.
GAM CLIGoogle Admin · CIS Google Workspace v1.3 1.1.1
gam print admins role "Super Admin"
Enforce 2-Step Verification and disallow SMS codes
Turn on 2-Step Verification enforcement across all organizational units and set Allowed methods to "Any except verification codes via text, phone call" so SIM-swapping attacks cannot hijack accounts.
Restrict default Google Drive link sharing
Change default Drive link sharing from "Anyone at your organization with the link" to "Restricted — Only people added can open with this link".
Free tool
Check your domain’s public mail and identity records →No sign-up required. Free Pistos Pharos utility.