Google Workspace Updates: Beta

More options for exporting your Google Workspace data are available in open beta

Friday, April 4, 2025

Update
[May 1, 2025] We have rolled this feature back while we evaluate performance and quality. We will provide an update with new rollout information for Rapid & Scheduled Release domains when possible.What’s changingBeginning today, Admins can choose from several options when exporting their organization’s data (also known as ‘takeout’). Specifically, they will be able to:

Export data from all or multiple services, such as Gmail, Chat, or Drive.

Export Drive data based on existing Drive labels

Export data from within a specific date range

Export data from selected shared drives

Exporting data for specific services

Exporting data based on specific Shared Drives

Exporting data based on specific or custom date range

Exporting data based on specific Drive labels

This update is available in open beta, which means no additional sign-up is required.

Who’s impacted

Admins

Why it’s important

In 2022, we introduced the ability for admins to export user generated content by organizational unit (OU) or group, and prior to that update, data export was limited to a customer’s full set of user generated content. With this update, we continue to give our customers more flexibility and specificity over the data they export, which is important as business and compliance needs evolve.

Getting started

Super Admins: Visit the Help Center to learn more about exporting your organization’s data and choosing the specific Workspace data you want to export.
End users: There is no end user impact or action required.

Rollout pace

Rapid Release and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on April 4, 2025

Availability

Available for Google Workspace Enterprise Plus customers with Assured Controls and Assured Controls Plus

Resources

Beta update: Data loss prevention rules based on classification labels are now applied instantly in Gmail on the web

Tuesday, March 18, 2025

What’s changingIn November 2024, we announced an open beta for data classification labels in Gmail. To further enhance the experience, we’re pleased to announce that auto-classification labeling with data loss prevention (DLP) rules and actions triggered by classification labels detected in the message will now be applied instantly when using Gmail on the web. Previously, users were informed of any implications after messages left the inbox. With this update, the feedback is instant, providing the opportunity to educate users on why their message is classified, blocked or quarantined, and how to remedy the issue to keep their email communications flowing. With this new functionality, and with this feature still in an open beta period, we strongly encourage you to continue providing feedback so we can optimize the feature for general availability. You can also use the form to sign-up for feedback sessions with the Google user research team to provide more detailed feedback.

Who’s impactedAdmins and end usersWhy it matters
Google Workspace's expansion of data classification labels to Gmail gives admins the ability to mitigate data exfiltration and gain a deeper understanding of shared data based on information type and sensitivity level to apply data protection policies appropriately. Some ways you can use Data Protection Rules with Classification Labels are:

Prevent messages based on a specific classification (e.g. Confidential, Internal, NTK) from being accidentally shared with unauthorized users.

You can create a rule with specific label(s) as a condition and choose an action to trigger when a message is sent:

Warn: users will see a notification that their message may contain sensitive information, helping to prevent accidental sharing. Note that this action does not block the message from being sent.
Block: users will be notified that their message will not be sent unless the label is changed or removed (if data organization policy allows).
You can also create a rule in a way that allows for sharing labeled messages only if confidential mode is enabled for the message.

Enforce classification on every message or specific messages

You can create a rule that warns users or blocks the message if a specific classification label is not found in the message. This can help educate users and drive adoption of your organization’s data classification policy among users.

Automatically apply classification labels messages if specific information types are found in the message

You can create a rule to automatically apply a specific classification label if certain criteria is met. For example, credit card information or medical information are contained within the email.
You can also configure the rule to allow users to modify the label to a more appropriate one based on the situation and data classification policy of your organization.

For more detailed information, please refer to our beta announcement as well as our Help Center.

Additional details

At this time, this update is only supported when using Gmail on the web. Stay tuned for further updates about instantaneous support in Gmail iOS and Android clients.

Getting started

Admins:

Gmail classification labels can be enabled at the ___domain, group level, or individual user level. You also have the option to enable existing classification labels used in Drive for use in Gmail. The Label Manager tool can be accessed by going to Security > Access and data control or admin.google.com/ac/dc/labels in the Admin console.
Visit the Help Center to learn more about getting started with classification labels, Gmail DLP & automatic classification labels, and preventing data leaks in email and attachments.
Please continue to share your feedback to help us optimize this feature for general availability.

End users:

Depending on the data loss prevention rules configured by your admin, you may see a dialog letting you know that your message cannot be shared and how to fix your message so it can safely be shared. Visit the Help Center to learn more about classification labels in Gmail.

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on March 18, 2025

Availability

The Label Manager and manual classification is available to Google Workspace:

Frontline Starter and Standard
Business Standard and Plus
Enterprise Standard and Plus
Education Standard and Education Plus
Essentials, Enterprise Essentials, and Enterprise Essentials Plus

Data loss prevention rules with labels as a condition or labels as an action are available to:

Enterprise Standard and Plus
Education Fundamentals, Standard, Plus, and the Teaching & Learning Upgrade
Frontline Standard
Cloud Identity Premium (with a Workspace Edition that includes Gmail)

Resources

Available in beta: Convert your client-side encrypted documents after a Vault or Takeout export

Monday, March 17, 2025

What’s changing After a Vault or Data export (takeout), admins can now convert their exported client-side encrypted documents to Word files. This allows organizations to maintain ownership over, access to, and analysis of sensitive data in a portable format even after it has been exported from Google Workspace.

Eligible Google Workspace admins can use this form to request access to the beta. We’ll share more specific instructions once you’re accepted into the beta.

Getting started

Admins: Client-side encryption can be enabled at the ___domain, OU, and Group levels (Admin console > Data > Compliance > Client-side encryption). Visit our Help Center to learn more about client-side encryption.

Rollout pace

The feature will be available immediately once you're accepted into the beta.

Availability

Available to Google Workspace Enterprise Plus, Education Standard and Education Plus customers.

Resources

Google Workspace Admin Help: About client-side encryption

Export your client-side encrypted documents to Microsoft Word files

Wednesday, March 12, 2025

What’s changing Launching in beta, you can now export client-side encrypted Google Docs to Word files. This means you'll continue to own the encryption keys that protect your files to prevent unauthorized access from any third party (including Google or foreign governments) but convert your files as needed.

Eligible Google Workspace admins can use this form to request access to the beta. We’ll share more specific instructions once you’re accepted into the beta.

In Google Docs, navigate to File > Download and decrypt.

Getting started

Rollout pace

The feature will be available immediately once you're accepted into the beta.

Availability

Available to Google Workspace Enterprise Plus, Education Standard and Education Plus customers

Resources

Beta application
Google Workspace Admin Help: About client-side encryption
Google Help: Get started with encrypted files in Drive, Docs, Sheets & Slides

Data classification labels in Gmail are now available on all Android and iOS devices

Tuesday, February 11, 2025

What’s changing In November 2024, we launched an open beta for data classification labels in Gmail. Beginning today, data classification labels will be available when using the Gmail app on mobile Android and iOS devices. Expanding data classification labels to mobile enables organizations to protect their data whether their users are sharing and accessing information from desktop devices or from mobile devices in the field or on-the-go.

Classification labels on mobile when composing a message, reading a message, and a message thread.

Additionally, these protections provide an automated way to enhance data security. For more information on data classification labels in Gmail, please refer to our original announcement.

Getting started

Admins:

If there are classification labels enabled for Gmail, users will start seeing classification fields in the compose flow on iOS and Android.
If you’re new to classification labels, they can be enabled at the ___domain, group level, or individual user level. Visit the Help Center to learn more about getting started with classification labels, Gmail DLP & automatic classification labels, and preventing data leaks in email and attachments.
Since this feature is still in an open beta period, and with the introduction of mobile support, we strongly encourage you to continue providing feedback so we can optimize the feature for general availability.

End users: If configured by your admin, you’ll see the “Classification” option when composing a new messaging or replying to or forwarding an existing message on mobile. When you open the menu, you can select labels relevant to your message. Visit the Help Center to learn more about adding classification labels in Gmail.

Rollout pace

Android: Available now
iOS: Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on February 11, 2025

Availability

The Label Manager and manual classification is available to Google Workspace:

Frontline Starter and Standard
Business Standard and Plus
Enterprise Standard and Plus
Education Standard and Education Plus
Essentials, Enterprise Essentials, and Enterprise Essentials Plus

Data loss prevention rules with labels as a condition or labels as an action are available to:

Enterprise Standard and Plus
Education Fundamentals, Standard, Plus, and the Teaching & Learning Upgrade
Frontline Standard
Cloud Identity Premium (in combination with a Workspace Edition eligible for Gmail)

Resources

Available in open beta: Set up Single-Sign On with custom OpenID Connect profiles

Tuesday, December 17, 2024

What’s changing

Beginning today, admins now have the option to set up a custom OpenID Connect (OIDC) profile for single sign-on (SSO) with Google as their Service Provider. OIDC is a popular method for verifying and authenticating the identities - this update gives admins more options for their end users to access cloud applications using a single set of credentials. Previously, only OIDC with pre-configured Microsoft Entra ID profile was supported in addition to SAML.

Custom OIDC profiles can be configured in the Admin console at >Security > Authentication > SSO with third party IdP

Getting started

Admins: This feature is available in open beta, which means you can use the feature without opting-in to a specific program. Visit the Help Center to learn more about SSO and configuring custom OIDC profiles for SSO via a third party identity provider.

Rollout pace

Rapid Release and Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on April 14, 2025

Availability

Available for all Google Workspace customers except Google Workspace Essentials Starter customers and Workspace Individual Subscribers
Also available for Cloud Identity and Cloud Identity Premium customers

Resources

Available in open beta: migrate messages from Microsoft Teams to Google Chat

Tuesday, December 17, 2024

What’s changingBeginning today, we’re expanding our data migration experience to include the ability for Google Workspace admins to migrate conversations from channels in Microsoft Teams to spaces in Google Chat, making it easier for organizations to onboard and deploy Chat. This can be done within the Admin console in a few steps:

First, connect to your Microsoft account.

Then, upload a CSV of the teams from where you want to migrate the messages. You can specify the source to destination identity mapping by uploading a CSV of the email ID’s from source to target.

You can only migrate data to accounts of existing users with a user license and the Google Chat service turned on. Visit our Help Center for more details.

Next, you’ll enter the starting date for messages to be migrated from Teams. Then you can begin your data migration.

Finally, you’ll complete the migration by making migrated spaces, messages and related conversation data available to Google Workspace users (see our Help Center article for specific details on supported data types).

Starting a chat migration in the admin console

When a migration starts, the UI displays a visual report that breaks down tasks with individual progress bars for tasks that are successfully completed, skipped, failed or have warnings.

The final step to complete the migration is to roll out spaces, making migrated spaces and their content available to users.

Additional details

The Chat migration tool doesn’t delete or modify existing Google Chat spaces or messages.
You can also run a delta migration, which will migrate any messages added to Teams channels since the primary migration. Messages that are already successfully migrated are skipped.
Once a migration is complete, you can export a report that contains detailed information regarding content that skipped, failed or had warnings during the migration.
You can find more information in our Help Center about migrating other forms of data from different types of source accounts.

Getting started

Admins:

Rollout pace

This feature is available now.

Availability

Available for all Google Workspace customers

Resources

Google Workspace Admin Help: Migrating chat messages

Available in open beta: prevent sensitive changes by locking Groups

Tuesday, December 10, 2024

What’s changingAdmins can now label a Google Group as “Locked,” which will heavily restrict changes to group attributes (such as group name & email address) and memberships. This will help admins who sync their groups from an external source and want to prevent getting out of sync, or who want to restrict changes to sensitive groups. This feature will be available in open beta, which means no additional sign-up is required.

The Group Details page in the Admin console shows a “Locked” label on the group, with the message “You can’t update this group - it might be managed by an external identity system.”

Who’s impactedAdminsWhy it’s importantIf you use third-party tools, like Entra ID, to manage group synchronization, you may encounter inconsistencies when modifications are made to these groups, like adding or removing members, for example. To help address this, we’re introducing the option to “lock” a group, which will prevent modifications within Google Workspace and help maintain synchronization with the external source. When a group is locked, only certain admins* can modify:

The group name, description, email, and alias(es)

Group labels

Memberships (adding or removing members) and member restrictions

Membership roles

Delete the group

Set up a new membership expiry

When a group is locked, access and content moderation settings are not affected, this includes:

Who can post

Who can view members

Who can contact members

Membership removals due to an existing membership expiry

Access or content moderation settings

*Super Admins, Group Admins, and Group Editors with a condition that includes “Locked Groups”

Additional details

By default, the changes listed above will be restricted from end users, including group owners and managers of a locked group. If you want to also restrict some admins from making these changes in the Admin Console or APIs, you can assign them the Group Editor role with a condition that excludes locked groups.

The ability to lock or unlock a group using the “Locked” label is available to Super Admins, Group Admins, or a custom role with the “Manage Locked Label” privilege. Lock a group using the “Locked” group label in the Admin Console, or the Cloud Identity Groups API.

Getting started

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on December 10, 2024

Availability

Available for Google Workspace:

Enterprise Standard and Plus
Enterprise Essentials Plus
Education Standard and Plus
Also available to Cloud Identity Premium customers

Resources

Google Workspace Admin Help: Lock groups to keep data in sync
Google Workspace Admin Help: Prebuilt Administrator Roles
Google Workspace Admin Help: Assign specific admin roles
API Documentation: Group Labels
API Documentation: Role Assignment

Available in beta: Convert your client-side encrypted spreadsheets after a Vault or Takeout export

Tuesday, December 3, 2024

What’s changingAfter a Vault or Data export (Takeout), admins can now convert their exported client-side encrypted spreadsheets to Excel files. This allows organizations to maintain access to and analysis of sensitive data in a portable format even after it has been exported from Google Workspace.
Eligible Google Workspace admins can use this form to request access to the beta. We’ll share more specific instructions once you’re accepted into the beta.

Getting started

Admins: Client-side encryption can be enabled at the ___domain, OU, and Group levels (Admin console > Data > Compliance > Client-side encryption). Visit our Help Center to learn more about client-side encryption.

Rollout pace

Rapid Release and Scheduled Release domains: The feature will be available immediately once you're accepted into the beta.

Availability

Available to Google Workspace Enterprise Plus, Education Standard and Education Plus customers

Resources

Google Workspace Admin Help: About client-side encryption

New beta that supports running Google Drive on Arm-compatible Windows PCs now available

Tuesday, December 3, 2024

What’s changingWe're excited to announce beta support for Drive for desktop on Windows 11 devices powered by Snapdragon processors. Compiled natively for ARM64, this release enables users to easily sync and store files online from Windows PCs powered by Snapdragon.

To opt-in to the beta, download and install the beta version of Google Drive for desktop on Arm-compatible Windows 11 device powered by Snapdragon. If you wish to opt-out at any time, disconnect your account and then uninstall the application.

Getting started

Admins: There is no admin control for this feature.
End users:

The beta version of Google Drive for desktop can only be installed on devices running Windows 11 and requires Microsoft WebView2, which is typically included with Windows 11. If it is missing or was previously removed, our installer will recommend you download and install it.
Note: This is a beta version and may contain bugs. It should be used with non-production data only. Alternatively, ensure that your data is backed up separately.
Should you encounter any issues, please submit feedback through the application. Kindly include logs to facilitate troubleshooting and assist us in improving the application.

Availability

Available to all Google Workspace customers, Workspace Individual Subscribers, and users with personal Google accounts

Resources

Data classifications labels for Gmail are now available in open beta

Friday, November 1, 2024

What’s changingIn addition to Google Drive, we’re expanding data classification labels to now include Gmail. Classification labels are used to classify and audit content according to organizational guidelines (“Sensitive”, “Confidential”, etc.) and apply policies, such as data loss prevention (DLP) rules, to protect sensitive information in email messages. Classification labels will be available when using Gmail on the web – support for Gmail on mobile devices will be introduced in the coming months.Who’s impactedAdmins and end usersWhy it’s importantData breaches are increasingly common and costly across all sectors, including enterprises, public sectors, and government institutions. To minimize data exfiltration and better understand the data being shared, organizations need to differentiate between various types of information and their sensitivity levels to apply data protection policies accordingly. By expanding data classification labels to Gmail, Google Workspace provides admins with a more flexible and robust system integrated with data protection capabilities to help organizations effectively categorize and protect sensitive information. Specifically, admins can create:

New classification labels or extend existing ones enabled in Drive labels for Gmail from the Label Manager. Labels can be used to denote department names, document types, document status, and other custom categories.

The Label Manager tool can be accessed in the Admin console by going to Security > Access and data control

Data protection rules with classification label as a condition, to apply actions to a message based on its classification. For example, a message will be blocked if it’s classified as ‘Internal’ and is being sent to an external recipient.

Notification about delivery failure due to DLP policy, blocking messages labeled as ‘Confidential’ to be sent to recipients outside of the organization

Data protection rules to automatically apply classification labels to a message, based on its content. For example, a ‘Confidential’ label can be applied to a message if it contains sensitive financial information, such as credit card or bank account numbers.

Data protection rule with ‘Apply a label’ action. Classification label specified in the rule will be applied to a message, if message contains information matching conditions of the rule

DLP rules with Confidential Mode as a condition to prevent sending messages with sensitive information, if it is not encrypted (Confidential Mode is not enabled)

Data protection rule is set up to detect messages with sensitive information (credit card or passport numbers) and confidential mode disabled in order to enforce sending such info with enhanced protection measures

End users can view and apply Classification Labels when using Gmail on the web.

Users can apply classification labels to a message, according to the organization’s data governance policies

Additional details

When Data loss prevention (DLP) rules for Gmail using classification labels either as a condition or as an action, messages are scanned asynchronously. This means that the message is classified, blocked or quarantined after it leaves the sender's mailbox) and before being dispatched to the recipient. In a future release, we plan to provide synchronous support with instant notifications consistent with our synchronous support of instant DLP enforcement for Gmail.

Note that:

If the message is blocked as a result of the classification label applied to it, the sender will get a bounce back message.
If the message is automatically labeled by a DLP rule, the sender will not see the label reflected in the sent message. The recipient will see the automatically applied label the same way as any other classification label applied manually by the sender.

Only Badged options list and Multiple Options list (Single select) field types are supported in Gmail. If classification labels are enabled for usage in both Gmail and Drive, and it contains fields that are not supported in Gmail, such as date or persona, Gmail users will see the label only with fields of the supported types.

Getting started

Admins:

Gmail classification labels can be enabled at the ___domain, group level, or individual user level. You also have the option to enable existing classification labels used in Drive for use in Gmail. The Label Manager tool can be accessed by going to Security > Access and data control or admin.google.com/ac/dc/labels in the Admin console.
Visit the Help Center to learn more about getting started with classification labels, Gmail DLP & automatic classification labels, and preventing data leaks in email and attachments.
Note: Labels can be viewed by any admin in your organization with the Manage Labels privilege. They can also be visible to everyone in your organization based on the label’s permissions settings.

End users: If configured by your admin, you’ll see the “Classification” option when composing a new messaging or replying to an existing message — when you open the menu, you can select labels relevant to your message. Visit the Help Center to learn more about adding classification labels in Gmail.

Rollout pace

Rapid Release and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on November 1, 2024

Availability

The Label Manager and manual classification is available to Google Workspace:

Frontline Starter and Standard
Business Standard and Plus
Enterprise Standard and Plus
Education Standard and Education Plus
Essentials, Enterprise Essentials, and Enterprise Essentials Plus

Data loss prevention rules with labels as a condition or labels as an action are available to:

Enterprise Standard and Plus
Education Fundamentals, Standard, Plus, and the Teaching & Learning Upgrade
Frontline Standard
Cloud Identity Premium (in combination with a Workspace Edition eligible for Gmail)

Resources

Google Workspace Admin Help: Gmail DLP & automatic classification labels (beta)
Google Workspace Admin Help: Get started as a classification labels admin
Google Workspace Admin Help: Prevent data leaks in email & attachments (beta)
Google Help: Add classification labels in Gmail

Expanding Google Workspace extensions available in open beta for the Gemini app

Monday, October 21, 2024

What’s changingEarlier this year, we launched Google Workspace extensions for Gmail, Google Drive and Google Docs in open beta for the Gemini app. Beginning today, we’re pleased to announce that Google Calendar, Google Keep and Google Tasks are also available as Workspace extensions in the Gemini app.Who’s impactedAdmins and end usersWhy you’d use itExtensions allow the Gemini app to interact with other Google apps and services, helping to provide more contextual and relevant responses to your prompts and take certain actions across apps. For example, you can use extensions to:

Calendar

Create an event in Google Calendar based on specific details or based on your conversation with the Gemini app
Find events for a specific day, date range, or based on event details
Edit or cancel events in Calendar

Tasks

Add reminders and tasks, including those based on your conversation with the Gemini app
View a list of your tasks and update your tasks

Keep

Create notes and lists, including those based on your conversation with the Gemini app
Add an item to your existing list
Find content from your notes and lists
Reference your notes and lists in your conversation with the Gemini app

Additional details

Getting started

Admins:

Google Workspace extensions in Gemini are OFF by default and can be enabled at the OU or Group level.

If Google Workspace extensions are already enabled, then the Workspace extensions for Calendar, Keep and Tasks will show up automatically for your users.

Visit the Help Center to learn more about turning Google Workspace extensions on or off for your organization.

End users: If enabled by your admin, connecting Google Workspace allows users to summarize, get quick answers, and find information from Calendar, Keep and Tasks in addition to Gmail, Docs, and Drive directly in Gemini. Visit the Help Center to learn more about using Google Workspace extensions.

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on October 21, 2024

Availability

Available for Google Workspace customers with these add-ons:

Gemini Business
Gemini Enterprise
Gemini Education
Gemini Education Premium

Resources

Available in open beta: Easily migrate files from Microsoft OneDrive to Google Drive

Friday, October 11, 2024

What’s changingUnder the umbrella of our data migration services, we’re introducing a new file migration service for Admins to transfer files between OneDrive data to Google Drive for up to 100 users at a time. Available directly under the Admin console, super admins can now migrate all your files and folders, as well as their corresponding access permissions with shared members. Starting a migration entails a few simple steps:

First, connect to the Microsoft OneDrive account you want to transfer files from

Next, set the migration scope by identifying the email addresses of Microsoft OneDrive users that you wish to migrate.

Finally, create an identity map to connect users on the source account to users on the target account.

Admin console > Data > Data import & export > Data migration > Go to data migration > Microsoft OneDrive

The console will provide reporting on the migration progression and metrics such as how many users have been processed, how many files have been migrated or skipped, and more. You’ll also have the option to export a migration report to further investigate errors and access troubleshooting tips directly from the tool. You can also make delta updates to migrate any new files that were added or updated after a previous migration.

Example of a completed migration

Who’s impacted

Admins

Why you’d use it

Data migrations play a critical role in ensuring a seamless transition between various tools and Google Workspace for both admins and end users. Workspace now offers a first party solution that allows our customers to migrate their data at scale, and without the need for third-party workarounds or on-premises infrastructure. This will significantly reduce the overall migration process and onboarding time to Google Workspace, saving customers considerable administrative and infrastructural costs. Additionally, it ensures minimal interruption for end users, who will be able to access all of their files and documents within Google Drive.

Getting started

Rollout pace

Rapid Release and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on October 11, 2024, with anticipated completion by November 15, 2024.

Availability

Available to Google Workspace

Business Starter, Standard, Plus
Enterprise Standard, Plus
Education Fundamentals, Standard, Plus, the Teaching and Learning Upgrade
Essentials Starter, Enterprise Essentials, Enterprise Essentials Plus
Nonprofits

Resources

Google Workspace Admin Help: Migrate files from a OneDrive account

Beta update: Data Loss Prevention enforcement in Gmail is now instantaneous

Thursday, October 3, 2024

What’s changing Today, we are announcing enhancements for the Data Loss Prevention for Gmail open beta, which are designed to improve usability without compromising sensitive data protections for Gmail. Once deployed, users will receive instant notifications on risks to applicable DLP policies prior to leaving their inbox, instead of having DLP rules evaluated after the message has already left the inbox. In addition to more timely user feedback, this capability, called synchronous DLP, helps educate users about the potential risk of leaking sensitive information.

We’re also introducing a new action for DLP rules, “Warn”, which will notify users about potentially sensitive data while providing the option to send the message based on a user’s assessment of a risk. For added safety, the DLP service will scan messages one additional time after they leave the sender's mailbox.

Who’s impacted

Admins and end users

Why it matters

Data breaches are one of the most common and costly security issues facing organizations. Often these breaches originate from within an organization by unintentional or intentional actions by their users. Data loss prevention capabilities help prevent this exfiltration of data and helps guide users about what information to share. To help safeguard sensitive information, organizations can create and enforce policies that not only detect and block sensitive information from being shared, but educate users on what information sharing is or is not appropriate and how to be compliant with those guidelines. Specifically, data loss prevention rules can look for sensitive text stings, custom detectors, or predefined detectors in outgoing messages sent internally or externally.

The latest update for data loss prevention rules in Gmail brings the experience in line with Google Drive and Google Chat, which are already adopted broadly by Google Workspace customers. You can refer to our Help Center for more information about data loss prevention in Gmail.

Additional details

Customizable warning messages

DLP rules can be configured to block the message, warn users about sensitive information, or quarantine the message. When sensitive information is detected, users will be shown a dialog box notifying them of the risk. Admins can now choose to customize the information shown to end users in these dialog boxes, including why their message was flagged, what they can do to unblock themselves, and links to additional resources to educate them further.

Example of a custom warning message

Continued asynchronous scanning of messages

While messages will now be scanned synchronously, messages will go through additional scanning asynchronously (after the message leaves the inbox) for an additional layer of protection. This includes messages that are sent automatically, such as auto-forward or scheduled send, and messages sent from non-Gmail clients.

Getting started

Admins:

End users: Depending on the data loss prevention rules configured by your admin, you may see a dialog letting you know that:

Your message is blocked: Your message contains information that cannot be shared — you’ll need to remove it in order to send your message.

Dialog in case of a blocked message

Rollout pace

Rapid Release and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on October 7, 2024

Availability

Available for Google Workspace:

Enterprise Standard, Enterprise Plus
Education Fundamentals, Standard, Plus, and the Teaching & Learning Upgrade
Frontline Standard
Cloud Identity Premium customers

Resources

Google Workspace Admin Help: Control sensitive data shared in Gmail

New beta available that restricts access to folders in Google Drive

Monday, September 16, 2024

What’s changingIf your admin has set up shared drives for their organization, shared drive managers were previously not able to restrict access to folders in shared drives. Today, we’re introducing a beta that allows shared drive managers to restrict folders to specific users within a shared drive. This provides shared drive managers with greater flexibility to keep relevant content within a single shared drive, while restricting access to shared folders with sensitive information.
A folder with “limited access” can only be opened by people who have been added to it directly. People with general access to the shared drive or shared folder can see the restricted folder in Drive, but will not be able to open it.
Eligible customers can use this form to express interest in the beta and will receive an email confirmation prior to the feature being enabled in their specified ___domain.

Who’s impacted Admins and end users

Why it’s important Folders with limited access allow users to organize files by project, in a single shared drive or shared folder, while ensuring that sensitive information is only accessible to the right team members.

Additional details Folders with limited access are available in both shared drives and My Drive:

Shared drive managers can always access folders with limited-access
Folder owners can always access limited-access folders in their My Drive

Getting started

For users whose access has been limited, you will see the folder name, but the folder will be grayed out:

Availability Available for Google Workspace:

Business Standard, Plus
Enterprise Standard, Plus
Essentials Starter, Enterprise Essentials, Enterprise Essentials Plus
Education Fundamentals, Standard, Plus, the Teaching & Learning Upgrade
Nonprofits

Resources

Available in open beta: configure third-party apps by select API scopes

Monday, August 5, 2024

What’s changing When your users sign in to third-party apps using the "Sign in with Google" option (single sign-on) or use OAuth to share their data with those apps, you can control what access those apps have to your organization’s Google data using app access controls.

Admins currently can configure the third-party apps as “Trusted”, giving them access to all OAuth scopes or as “Limited”, giving them access to scopes only from Google services which are not restricted. Beginning today, we’re giving admins another layer of granular control for third-party apps. Specifically, you can now configure apps to be limited by selected OAuth 2.0 Scopes for Google APIs, such as Drive or Gmail scopes. This helps ensure that these apps do not gain additional access without admin consent based on new API scopes that they might request in the future, keeping data access limited to only what is deemed absolutely necessary by admins.

Getting started

Admins: To manage app access, in the Admin console navigate to Security > API Controls > App Access Controls. Visit the Help Center to learn more about controlling which third-party & internal apps access Google Workspace data.

Rollout pace

Rapid and Scheduled Release domains: Available now.

Availability

Available to all Google Workspace customers, as well as Cloud Identity Free and Premium customers

Resources

Useful Links

Join the official community for Google Workspace administrators

In the Google Cloud Community, connect with Googlers and other Google Workspace admins like yourself. Participate in product discussions, check out the Community Articles, and learn tips and tricks that will make your work and life easier. Be the first to know what's happening with Google Workspace.

______________

Learn about more Google Workspace launches

On the “What’s new in Google Workspace?” Help Center page, learn about new products and features launching in Google Workspace, including smaller changes that haven’t been announced on the Google Workspace Updates blog.

______________

Updates

More options for exporting your Google Workspace data are available in open beta

Beta update: Data loss prevention rules based on classification labels are now applied instantly in Gmail on the web

Available in beta: Convert your client-side encrypted documents after a Vault or Takeout export

Export your client-side encrypted documents to Microsoft Word files

Data classification labels in Gmail are now available on all Android and iOS devices

Available in open beta: Set up Single-Sign On with custom OpenID Connect profiles

Available in open beta: migrate messages from Microsoft Teams to Google Chat

Available in open beta: prevent sensitive changes by locking Groups

Available in beta: Convert your client-side encrypted spreadsheets after a Vault or Takeout export

New beta that supports running Google Drive on Arm-compatible Windows PCs now available

Data classifications labels for Gmail are now available in open beta

Expanding Google Workspace extensions available in open beta for the Gemini app

Available in open beta: Easily migrate files from Microsoft OneDrive to Google Drive

Beta update: Data Loss Prevention enforcement in Gmail is now instantaneous

New beta available that restricts access to folders in Google Drive

Available in open beta: configure third-party apps by select API scopes

Filter by product

Filter by date

Subscribe by feed

Subscribe by email

Localized Google Workspace Updates

Useful Links

Join the official community for Google Workspace administrators

Learn about more Google Workspace launches