Google Workspace Updates: Security and Compliance

Granular OAuth consent in HTTP Google Workspace add-ons

Tuesday, May 6, 2025

What’s changingGranular OAuth consent is rolling out over the next few weeks for Google Workspace add-ons built using HTTP endpoints. Granular consent gives users clear choices about the data they share with third-party applications.This update is similar to an update made earlier this year with the introduction of granular OAuth consent in the Google Apps Script IDE: when someone installs or runs an HTTP Workspace add-on that supports granular consent, they will see a redesigned consent screen. Instead of being asked to authorize all requested permissions at once, users can selectively grant access to individual OAuth scopes.For example, Google Workspace add-ons can extend to multiple Workspace apps, but users might only use an add-on for some of the apps it extends. With granular consent, users can choose to grant all permissions to an add-on or grant permissions as needed when they use the add-on in each app.

This screenshot shows the new OAuth consent screen, which lets the user provide consent for a subset of the requested OAuth scopes.
Additional detailsFollowing is the timeline for developers supporting granular consent in HTTP Google Workspace add-ons:

New HTTP Google Workspace add-ons built after May 27, 2025 must support granular consent.

Existing add-ons have until December 1, 2025 to add support for granular consent.

After December 1, 2025, all HTTP Google Workspace add-ons must support granular consent.

After a user grants permission to a Google Workspace add-on that supports granular consent, the add-on might request OAuth consent again in the following cases:

The user, who has granted consent to a subset of the requested OAuth scopes, tries to run a part of the add-on that requires scopes that were not previously authorized.

The add–on is updated in such a way that it requires permission for additional scopes.

The user revoked access to the add-on from their Google Account settings.

This update does not apply to the following scenarios, for which granular consent may become available in the future:

When an admin initially installs an add-on

When an admin updates the permissions granted to an add-on from the Admin console

If a Google Workspace add-on is built in Apps Script

Getting Started

Admins: There are no changes to the admin controls for this feature.
Developers: For information about how to add support for granular consent to HTTP Workspace add-ons, refer to the developer documentation.
End users: This new consent screen will only be used for new OAuth scope grants. Pre-existing scope grants will not be affected, so no action is required by users on add-ons they’ve already authorized.

Rollout pace

Rapid Release and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on May 6, 2025, with expected completion by May 19, 2025

Availability

Available to all Google Workspace customers and Workspace Individual Subscribers

Resources

Pre-configure Gemini app conversation history admin settings before they take effect

Monday, May 5, 2025

[Update - May 8, 2025]: This enforcement of these settings is anticipated to start on May 22, 2025. We will share another update in the coming days to provide final confirmation and further details about the rollout.

What’s changingStarting today, Workspace admins can pre-configure the new Gemini conversation history admin settings before they take effect for their Gemini app users (expected by the end of May 2025). By default, “Gemini conversation history” will be ON and ”Conversation retention” will be set to 18 months (inline with current behavior).

Generative AI > Settings > Gemini app > Gemini conversation history

Who’s impactedAdmins and end usersAdditional details

If "Gemini conversation history" is OFF, chats are saved in user accounts for up to 72 hours. This lets Google provide the service and process any feedback. This chat activity won’t appear in a user’s Gemini Apps Activity.

Regardless of whether the Gemini app history is on or off, content in chats adheres to enterprise privacy and security protections as described in the Google Workspace Terms of Service. You can also learn more in the Privacy Hub.
If you turn the setting from ON to OFF, existing user conversation history from before the setting is turned OFF is stored for the length of time specified by the "Conversation retention" setting.

This update will not impact your current Gemini app service setting.

This update will not impact Gemini in Workspace apps (e.g., Gemini in Gmail).

Getting started

Admins:

Review and update the "Gemini conversation history" settings before we enforce these settings (expected by the end of May 2025). Visit the Help Center to learn more about configuring Gemini app conversation history settings for your users.
If no changes are made, the default settings will apply: “Gemini conversation history” set to ON and "Conversation retention” set to 18 months. Activity older than 18 months will be automatically deleted.

End Users:

Users cannot override the Gemini conversation history settings configured by their admin.
These admin settings will override any individual user changes previously made to their Gemini Apps Activity settings (gemini.google.com or Gemini mobile app).

Rollout pace

Rapid Release and Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on May 5, 2025

We will publish a separate Workspace Updates blog post once we begin to enforce these settings, which is expected by the end of May 2025.

Availability

Available for all Google Workspace users with access to the Gemini app.

Resources

Google Workspace Admin Help: Turn the Gemini app on or off

Enhance Your Organization’s Security with Out-of-Domain File Warnings in Google Workspace

Monday, April 28, 2025

What’s changingToday we’re launching Out-of-Domain file-level warnings, now publicly available to all Google Workspace users. Specifically, a badge will be displayed on Google Docs, Sheets, and Slides files when the file is owned by or shared with someone outside of your ___domain. You'll also see a pop-up with more details and the option to report the externally owned file for abuse.

An image showing a Google Doc with the word "External" displayed in a small yellow badge next to the document title. The badge has been clicked, and a pop-up window appears with more information stating that “This document is owned by someone outside your organization. Be cautious about sharing sensitive information

Image of "External" badge displayed in Google Docs
This feature helps users identify potentially risky files and avoid phishing scams when working with files shared from outside your organization.

Additional details

Known Limitations:

For externally shared content, the badge will not be displayed if any internal Google Groups have access to the document, even if these groups have external members.
If any service accounts have access to the document, the External badge will be displayed, even if the service account is owned internally.

Getting started

Admins: This feature will be ON by default and can be disabled at the ___domain and organizational level. Visit the Help Center to learn more about turning Out-of-Domain Warnings on or off for your organization.

Screenshot of the Google Workspace Admin console, navigated to Sharing settings. At the bottom of the page, a new section labeled "Highlight external files" is highlighted. The checkbox is checked, and the description reads: "Mark external files shared or owned externally as “external” to flag that content may be viewable outside your organization.

Image of the Google Workspace Admin console, Sharing settings, showing the "Highlight external files" option enabled

End users: This feature is ON by default unless otherwise configured by your admin. There is no end user setting for this feature. Visit the Help Center to learn more about Out-of-Domain file warnings.

Rollout pace

Admin setting:

Rapid Release and Scheduled Release domains: The admin setting will start rolling out today, April 28, 2025, and continue over the next several days.

End user visibility:

Rapid Release and Scheduled Release domains: End user visibility will begin on May 5, 2025 and is expected to take one week to complete.

Availability

Available for all Google Workspace customers, as well as Cloud Identity customers

Resources

Data classifications labels for Gmail are now generally available

Wednesday, April 23, 2025

What’s changing In 2024 we introduced data classification labels for email in open beta, and since then we’ve introduced several feature enhancements including:

Auto-classification labeling with data loss prevention (DLP) rules.
Instant application of DLP rules and actions triggered by classification labels on the web.
“Sensitive content snippets” for Gmail messages that trigger data loss prevention rules.
Events related to labeling, like “label_applied” or “label_removed” are now included in audit logs, allowing admins to generate reports based on label values for further analysis.
Support on Android and iOS devices.

Beginning today, we are pleased to announce that data classification labels are generally available, giving admins yet another way to enhance their security posture.

Who’s impacted

Admins and end users

Why it matters

Data breaches are increasingly common and costly across all organizations, including enterprises, public sectors, and government institutions. By extending data classification labels to Gmail, Google Workspace offers admins a more comprehensive and integrated system for protecting sensitive information.

Admins can create custom labels or leverage existing Drive labels within Gmail, enabling classification of emails based on department, document type, sensitivity, and more. This allows for the creation of targeted data protection rules, such as blocking the sending of internal-labeled emails to external recipients or automatically applying a confidential label to messages containing sensitive financial data.

The instant application of auto-classification and DLP rules in Gmail provides immediate feedback to users, educating them on data protection policies and allowing them to rectify issues before emails are sent, ultimately minimizing data breaches and improving overall data security.

Finally,availability on mobile devices provides a comprehensive experience, ensuring data is protected and labeled across all user devices, whether users are sharing and accessing information from desktop devices or from mobile devices on-the-go.

Additional details

To further enhance the data classification labels experience, instant application of DLP rules and actions triggered by classification labels will soon be generally available on mobile devices. We anticipate that this functionality will be available in May – we’ll share an update once we have more information.

Getting started

Admins:

If you've been using classification labels since the open beta period, there are no changes to your experience.
If you’re new to Gmail classification labels, they can be enabled at the ___domain, group level, or individual user level. You also have the option to enable existing classification labels used in Drive for use in Gmail. The Label Manager tool can be accessed by going to Security > Access and data control or admin.google.com/ac/dc/labels in the Admin console. Visit the Help Center to learn more about getting started with classification labels, Gmail DLP & automatic classification labels, and preventing data leaks in email and attachments.

The Label Manager tool can be accessed in the Admin console by going to Security > Access and data control

End users: Depending on the data loss prevention rules configured by your admin, you may see a dialog letting you know that your message cannot be shared and how to fix your message so it can safely be shared. Visit the Help Center to learn more about classification labels in Gmail.

Users can apply classification labels to a message, according to the organization’s data governance policies

Classification labels on mobile when composing a message and reading a message

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on April 23, 2025

Availability

The Label Manager and manual classification is available to Google Workspace:

Frontline Starter and Standard
Business Standard and Plus
Enterprise Standard and Plus
Education Standard and Education Plus
Essentials, Enterprise Essentials, and Enterprise Essentials Plus

Data loss prevention rules with labels as a condition or labels as an action are available to:

Enterprise Standard and Plus
Education Fundamentals, Standard, Plus, and the Teaching & Learning Upgrade
Frontline Standard
Cloud Identity Premium (in combination with a Workspace Edition that includes Gmail)

Resources

Google Workspace Admin Help: Gmail DLP & automatic classification labels 

Google Workspace Admin Help: Prevent data leaks in email & attachments 

Google Workspace Admin Help: Get started as a classification labels admin

Google Help: Add classification labels in Gmail

The Gemini app, as well as Gemini features in Google Workspace, are now BSI C5 certified

Thursday, April 10, 2025

What’s changing Today at Google Cloud Next 2025, we announced that the Gemini in Google Workspace apps and the Gemini App have achieved the German BSI C5 attestations – the first AI productivity assistant to achieve this certification. For our customers operating in the EU, this means they can confidently adopt and integrate AI into their work with assurances that stringent third-party auditors have determined that Gemini’s architecture meets a high bar of security and privacy.
This latest certification continues to build on Gemini’s existing, comprehensive set of safety, privacy, and security standards, including: SOC 1/2/3, ISO 27017/18, and ISO 42001 (the first international standard for AI Management Systems), as well as HIPAA compliance and as the first generative AI assistant to achieve US FedRAMP High attestations.
Getting started

Admins: Visit the Help Center to learn more about how Google Workspace satisfies certification and compliance standards and BSI C5 in general.

Availability

This update impacts all Google Workspace users accessing the Gemini in Google Workspace and the Gemini app.

Resources

Gmail data loss prevention now supports “sensitive content snippets”

Tuesday, March 18, 2025

What’s changingWe recently launched data loss prevention for Gmail and, beginning today, Admins can see “Sensitive content snippets” for Gmail messages that trigger data loss prevention rules. This content is logged in the security investigation tool and admins can use the information to better identify security risks, determine whether a false positive was returned, and decide on an appropriate course of action.Snippets are already available for DLP events for Drive, Chat, and Chrome. Visit our Help Center and our previous announcement for more information.

Matched content and information about the data detector type is displayed in the side panel under ‘Log Details’ in the Security Investigation Tool
Getting started

Admins:

Make sure any admins who need to review the snippets have the "view sensitive content" privilege. Only super admins have the ability to hide or unhide sensitive data from the log details.
Visit the Help Center to learn more about preventing data leaks in email and attachments, viewing content snippets that trigger DLP rules, using Workspace DLP to prevent data loss, and the security investigation tool.
DLP Snippets can be configured in the Admin console by going to Security > Data Protection > Data Protection Settings > Sensitive Content Storage. To view snippets in the security investigation tool, select any row from the “Description column” and scroll down to “Sensitive Content Snippets”. Here you’ll see the matched detector ID, the matched content starting character, and the matched content length.

Rollout pace

Rapid Release and Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on March 18, 2025

Availability

Available to Google Workspace

Frontline Standard
Enterprise Standard and Plus
Education Fundamentals, Standard, Plus, and the Teaching and Learning add-on
Enterprise Essentials Plus
Also available for Chrome Enterprise Premium

Resources

Google Workspace Admin Help: Prevent data leaks in email & attachments

Google Workspace Admin Help: View content that triggers DLP rules (beta)

Google Workspace Admin Help: Use Workspace DLP to prevent data loss

Google Workspace Admin Help: About the security investigation tool

Google Workspace Updates Blog: Workspace data loss protection (DLP) for Gmail is now generally available

Beta update: Data loss prevention rules based on classification labels are now applied instantly in Gmail on the web

Tuesday, March 18, 2025

What’s changingIn November 2024, we announced an open beta for data classification labels in Gmail. To further enhance the experience, we’re pleased to announce that auto-classification labeling with data loss prevention (DLP) rules and actions triggered by classification labels detected in the message will now be applied instantly when using Gmail on the web. Previously, users were informed of any implications after messages left the inbox. With this update, the feedback is instant, providing the opportunity to educate users on why their message is classified, blocked or quarantined, and how to remedy the issue to keep their email communications flowing. With this new functionality, and with this feature still in an open beta period, we strongly encourage you to continue providing feedback so we can optimize the feature for general availability. You can also use the form to sign-up for feedback sessions with the Google user research team to provide more detailed feedback.

Who’s impactedAdmins and end usersWhy it matters
Google Workspace's expansion of data classification labels to Gmail gives admins the ability to mitigate data exfiltration and gain a deeper understanding of shared data based on information type and sensitivity level to apply data protection policies appropriately. Some ways you can use Data Protection Rules with Classification Labels are:

Prevent messages based on a specific classification (e.g. Confidential, Internal, NTK) from being accidentally shared with unauthorized users.

You can create a rule with specific label(s) as a condition and choose an action to trigger when a message is sent:

Enforce classification on every message or specific messages

You can create a rule that warns users or blocks the message if a specific classification label is not found in the message. This can help educate users and drive adoption of your organization’s data classification policy among users.

Automatically apply classification labels messages if specific information types are found in the message

You can create a rule to automatically apply a specific classification label if certain criteria is met. For example, credit card information or medical information are contained within the email.
You can also configure the rule to allow users to modify the label to a more appropriate one based on the situation and data classification policy of your organization.

For more detailed information, please refer to our beta announcement as well as our Help Center.

Additional details

At this time, this update is only supported when using Gmail on the web. Stay tuned for further updates about instantaneous support in Gmail iOS and Android clients.

Getting started

Admins:

Gmail classification labels can be enabled at the ___domain, group level, or individual user level. You also have the option to enable existing classification labels used in Drive for use in Gmail. The Label Manager tool can be accessed by going to Security > Access and data control or admin.google.com/ac/dc/labels in the Admin console.
Visit the Help Center to learn more about getting started with classification labels, Gmail DLP & automatic classification labels, and preventing data leaks in email and attachments.
Please continue to share your feedback to help us optimize this feature for general availability.

End users:

Depending on the data loss prevention rules configured by your admin, you may see a dialog letting you know that your message cannot be shared and how to fix your message so it can safely be shared. Visit the Help Center to learn more about classification labels in Gmail.

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on March 18, 2025

Availability

The Label Manager and manual classification is available to Google Workspace:

Frontline Starter and Standard
Business Standard and Plus
Enterprise Standard and Plus
Education Standard and Education Plus
Essentials, Enterprise Essentials, and Enterprise Essentials Plus

Data loss prevention rules with labels as a condition or labels as an action are available to:

Enterprise Standard and Plus
Education Fundamentals, Standard, Plus, and the Teaching & Learning Upgrade
Frontline Standard
Cloud Identity Premium (with a Workspace Edition that includes Gmail)

Resources

Admins can now deploy Context-Aware Access for NotebookLM and NotebookLM Plus

Monday, March 17, 2025

What’s changingBuilding upon the recent announcement of NotebookLM and NotebookLM Plus becoming available as a Google Workspace core service with enterprise-grade data protection, we’re excited to introduce the ability for admins to specify Context-Aware Access (CAA) policies when their users access NotebookLM and NotebookLM Plus.

Context Aware Access support for NotebookLM

Who’s impacted Admins and end users

Why it’s importantUsing Context-Aware Access, admins can set up different access levels for NotebookLM and NotebookLM Plus based on a user’s identity and the context of the request (___location, device security status, IP address). This can help provide granular access controls without the need for a VPN, and give users access to Google Workspace resources based on organizational policies.

Getting started

Rollout pace

Rapid Release and Scheduled Release domains: Available now.

Availability Context-Aware Access is available for Google Workspace:

Enterprise Standard and Plus
Education Standard and Plus
Enterprise Essentials Plus
Frontline Standard
Cloud Identity Premium

Resources

Available in beta: Convert your client-side encrypted documents after a Vault or Takeout export

Monday, March 17, 2025

What’s changing After a Vault or Data export (takeout), admins can now convert their exported client-side encrypted documents to Word files. This allows organizations to maintain ownership over, access to, and analysis of sensitive data in a portable format even after it has been exported from Google Workspace.

Eligible Google Workspace admins can use this form to request access to the beta. We’ll share more specific instructions once you’re accepted into the beta.

Getting started

Admins: Client-side encryption can be enabled at the ___domain, OU, and Group levels (Admin console > Data > Compliance > Client-side encryption). Visit our Help Center to learn more about client-side encryption.

Rollout pace

The feature will be available immediately once you're accepted into the beta.

Availability

Available to Google Workspace Enterprise Plus, Education Standard and Education Plus customers.

Resources

Google Workspace Admin Help: About client-side encryption

Consent re-confirmation for under 18 users accessing Additional Services will soon be required

Friday, March 14, 2025

What’s changingWhen a Google Workspace for Education admin chooses to enable Additional Services for students under the age of 18 to use, they acknowledge that they may be required to collect parental or guardian consent. This includes access to services like YouTube, Google Translate, Google Photos, Google Books, Google Earth and more.In September 2024, we communicated that we now require admins who have Additional Services enabled for users under the age of 18 to re-review them on an annual basis. Admins are always in control of which services their users have access to, and this gives admins an opportunity to ensure the right users have access to the right services.

If admins do not want to provide access to Additional Services for their under 18 users, they can turn them off for those users.

If admins want to keep Additional services enabled for under 18 users, they need to reconfirm parental consent in the admin console.

If admins do not take action, under 18 users who previously had access to Additional Services will lose access in the coming weeks. Admins can re-enable access to Additional Services at any time.

How admins can take action
Admins were first provided notice of this re-confirmation requirement in September 2024, which indicated a 6 months notice to complete the re-review process before the March 2025 rollout. The banner in the admin console has turned red to alert admins that action is required. While the rollout begins in March, it might take several weeks before some users in your organization are impacted.You can easily view which applications require consent reconfirmation from Admin console > Apps > Additional Google services. You can re-confirm consent by checking the box next to the app, hovering over the app, or using the three-dot overflow menu.

Experience for impacted end users

If users lose access to a specific service they’ll be notified “Your Google Workspace for Education account is designated as under 18 and your organization’s admin has not granted you access to this Additional Service. To regain access, inform your admin that you need this service to be enabled.“

Who’s impacted

Admins and end users under the age of 18

Why it’s important

Admins are in control of which services their users have access to, and to do so in alignment with both our terms of service and local laws and regulations that determine what services are appropriate for users under 18. Since admins manage which services their students have access to, only they can enable or disable access for their under 18 users.

This is a guide to support admins with collecting consent from parents, which includes this template for communicating with parents and guardians around collecting consent.

Additional details

The requirement to review and re-confirm access to Additional Products is an annual requirement customers must complete for their under 18 users, subject to their Google Workspace for Education Terms of Service.

Getting started

Rollout pace

Rapid Release and Scheduled Release domains: This update will start taking effect as early as March 2025, though it may take several weeks to reach all customers.

Availability

This change impacts Google Workspace:

Education Fundamentals, Standard, and Plus

Resources

Export your client-side encrypted documents to Microsoft Word files

Wednesday, March 12, 2025

What’s changing Launching in beta, you can now export client-side encrypted Google Docs to Word files. This means you'll continue to own the encryption keys that protect your files to prevent unauthorized access from any third party (including Google or foreign governments) but convert your files as needed.

Eligible Google Workspace admins can use this form to request access to the beta. We’ll share more specific instructions once you’re accepted into the beta.

In Google Docs, navigate to File > Download and decrypt.

Getting started

Admins: Client-side encryption can be enabled at the ___domain, OU, and Group levels (Admin console > Data > Compliance > Client-side encryption). Visit our Help Center to learn more about client-side encryption.
End users: To export your client-side encrypted Google Doc to a Microsoft Word file go to File > Download and decrypt > Microsoft Word (.docx).

Rollout pace

The feature will be available immediately once you're accepted into the beta.

Availability

Available to Google Workspace Enterprise Plus, Education Standard and Education Plus customers

Resources

Beta application
Google Workspace Admin Help: About client-side encryption
Google Help: Get started with encrypted files in Drive, Docs, Sheets & Slides

The Policy API is now generally available with support for auditing more security features

Thursday, February 20, 2025

What’s changing We recently introduced the Policy API in open beta, letting super admins programmatically access information regarding how their Google Workspace environment service level settings and rules are configured. Beginning today, the Policy API is now generally available with more functionality:
Admins can now use the API to audit more settings, specifically:

Calendar
Gmail
Multi-factor authentication settings (2-Step Verification)

Refer to our developer documentation for a full list of settings that can be audited by the API.

Who’s impacted Super admins

Why it’s important Simplifying the management of Workspace settings continues to be a priority for us. The Policy API is an important new tool that helps streamline the process by providing a comprehensive view of security settings as needed, eliminating the need to navigate to numerous pages in the Admin console. In forthcoming releases, the Policy API will also include the ability to configure settings.

Due to the increasing sophistication and scale of cyber threats, the Cybersecurity & Infrastructure Security Agency’s Secure Cloud Business Applications (SCuBA) project provides guidance to help agencies secure their cloud business application environments. The general availability of Google’s Workspace Policy API marks a significant milestone, enabling CISA to expand Scuba Goggles’ capabilities in assessing Google Workspace environments against CISA’s SCuBA secure configuration baselines. This advancement helps organizations better align with industry-leading security practices while maintaining operational efficiency.

ScuBA has published a new release to leverage the GWS Policy API with ScubaGoggles, an automated assessment tool that compares tenant configurations with CISA’s Google Workspace Secure Configuration Baselines.

Getting started

Admins:

You must be a super admin to use the Policy API. Use our developer documentation to learn more about the Policy API.
You can also use GAM, an open source tool for managing Workspace, which now supports the Policy API.

End users: There is no end user impact or action required.

Rollout pace

Rapid Release and Scheduled Release domains: Available now.

Availability

Available to all Google Workspace customers.

Resources

Policy API Overview
Developer Documentation: REST Resource: policies
Workspace Updates Blog: Audit security settings using the Policy API, now available in open beta

Workspace data loss protection (DLP) for Gmail is now generally available

Tuesday, February 18, 2025

What’s changing A big threat organizations must prepare for is the risk of data exfiltration through unwanted and/or unauthorized means. Whether it’s small-scale, unintended sharing, or a larger breach scenario, organizations need powerful defenses to protect themselves from these risks. To that end, we’re pleased to announce that today Data Loss Prevention (DLP) is generally available in Gmail, alongside Drive and Chat.DLP is one of the most powerful ways organizations can protect themselves from these risks. With DLP capabilities in Gmail, organizations can identify, monitor, and control the sharing of sensitive data. It works through a series of easy to apply data protection rules that can be implemented to instantly detect sensitive content in outgoing messages, including body content, attachments, headers, and subject lines.

Additional details

How does DLP in Gmail compare to Content Compliance rules?

To prevent the exfiltration of sensitive data from Gmail, data protection rules with DLP are recommended. These rules offer a rich set of predefined detectors and the ability to build flexible conditions.

Additionally, organizations can tailor warning messages based on their organization's data governance requirements, terminology, and processes; these messages will help educate users on their organization's specific security and data protection policies to prevent sharing sensitive content.

Other features, such as content compliance, can still be used for different purposes, like evaluating inbound messages and routing them internally to relevant departments.

For more information, please refer to our initial open beta announcement.

DLP within the Google Workspace ecosystem

As part of Google Workspace ecosystem, DLP for Gmail comes with capabilities available across other applications, such as Drive and Chat, so admins can configure, implement and investigate Data Loss Prevention incidents using unified tools, such as Security Investigation Tool, or build custom dashboards using unified audit logs or export to BigQuery.

Taken together, DLP capabilities across Workspace provide powerful protections for organizations to reduce the risk of data breaches, comply with regulatory requirements, and protect their reputation and intellectual property.

Getting started

Admins:

End users: Depending on your admin configuration, you’ll be notified if your message contains information that violates DLP rules.

Rollout pace

Rapid Release and Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on February 18, 2025

Availability

Available to Google Workspace:

Enterprise Standard, Enterprise Plus
Education Fundamentals, Standard, Plus, and the Teaching & Learning add-on
Frontline Standard
Cloud Identity Premium customers

Resources

Data classification labels in Gmail are now available on all Android and iOS devices

Tuesday, February 11, 2025

What’s changing In November 2024, we launched an open beta for data classification labels in Gmail. Beginning today, data classification labels will be available when using the Gmail app on mobile Android and iOS devices. Expanding data classification labels to mobile enables organizations to protect their data whether their users are sharing and accessing information from desktop devices or from mobile devices in the field or on-the-go.

Classification labels on mobile when composing a message, reading a message, and a message thread.

Additionally, these protections provide an automated way to enhance data security. For more information on data classification labels in Gmail, please refer to our original announcement.

Getting started

Admins:

If there are classification labels enabled for Gmail, users will start seeing classification fields in the compose flow on iOS and Android.
If you’re new to classification labels, they can be enabled at the ___domain, group level, or individual user level. Visit the Help Center to learn more about getting started with classification labels, Gmail DLP & automatic classification labels, and preventing data leaks in email and attachments.
Since this feature is still in an open beta period, and with the introduction of mobile support, we strongly encourage you to continue providing feedback so we can optimize the feature for general availability.

End users: If configured by your admin, you’ll see the “Classification” option when composing a new messaging or replying to or forwarding an existing message on mobile. When you open the menu, you can select labels relevant to your message. Visit the Help Center to learn more about adding classification labels in Gmail.

Rollout pace

Android: Available now
iOS: Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on February 11, 2025

Availability

The Label Manager and manual classification is available to Google Workspace:

Frontline Starter and Standard
Business Standard and Plus
Enterprise Standard and Plus
Education Standard and Education Plus
Essentials, Enterprise Essentials, and Enterprise Essentials Plus

Data loss prevention rules with labels as a condition or labels as an action are available to:

Enterprise Standard and Plus
Education Fundamentals, Standard, Plus, and the Teaching & Learning Upgrade
Frontline Standard
Cloud Identity Premium (in combination with a Workspace Edition eligible for Gmail)

Resources

Know who an event is shared with when using shared Google Calendars

Tuesday, February 4, 2025

What’s changing Users can have one of the following access permissions for shared Google Calendars:

“See only free/busy (hide details)”
“See all event details”
“Make changes to events”
“Make changes and manage sharing”

The “Make changes to events” permission enables users to create events on shared calendars, but when those events are created, the user does not know which other users the event is shared with.
To improve upon experience and ensure users are aware of who they are sharing content with, users with the ability to “Make changes to events” can now see the members of the shared calendar, i.e. who their events are shared with.

users with the ability to “Make changes to events” can now see the members of the shared calendar, i.e. who their events are shared with.

Getting started

Admins: As an admin, you can control how much calendar information people in your organization can share with users external to your organization. You can also set the default level of sharing for users within your organization. Visit the Help Center to learn more about setting Calendar sharing options.
End users: On Calendars with “make changes to events” access permission, you will now see the members of calendars. You can control the access permission of other users for your Calendars only on Calendars with “make changes and manage sharing” access permissions. Visit the Help Center to learn more about sharing your calendar with someone.
Developers: For Calendars where a user has “make changes to events” (aka “writer”) permissions, the Acl.list and Acl.get method will newly return the members of the shared calendar and Acl.watch will notify about changes to members.

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on February 4, 2025

Availability

Available to all Google Workspace customers, Workspace Individual Subscribers, and users with personal Google accounts

Resources

Better understand app access with the new Access Evaluation log event

Thursday, January 30, 2025

What’s changing We’re introducing a new log event, Access Evaluation, which will help admins better understand how security policies affect their users' access to OAuth apps. This includes settings and policies such as API controls, endpoint management configurations, ___domain wide delegation and more. The log contains information on the specific policies applied, when access was granted and the reasoning. Admins can use this information to review their security policies and revise them as needed to protect the sharing of Workspace data with users' apps.

Example of an Access Evaluation log

Getting started

Rollout pace

Rapid Release and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on January 30, 2025

Availability

Available in the audit and investigation tool for all Google Workspace customers.
Available in the security investigation tool for Google Workspace:

Frontline Standard
Enterprise Standard and Plus
Education Standard and Plus
Enterprise Essentials Plus
Cloud Identity Premium

Resources

Useful Links

Join the official community for Google Workspace administrators

In the Google Cloud Community, connect with Googlers and other Google Workspace admins like yourself. Participate in product discussions, check out the Community Articles, and learn tips and tricks that will make your work and life easier. Be the first to know what's happening with Google Workspace.

______________

Learn about more Google Workspace launches

On the “What’s new in Google Workspace?” Help Center page, learn about new products and features launching in Google Workspace, including smaller changes that haven’t been announced on the Google Workspace Updates blog.

______________

Updates

Granular OAuth consent in HTTP Google Workspace add-ons

Pre-configure Gemini app conversation history admin settings before they take effect

Enhance Your Organization’s Security with Out-of-Domain File Warnings in Google Workspace

Data classifications labels for Gmail are now generally available

The Gemini app, as well as Gemini features in Google Workspace, are now BSI C5 certified

Gmail data loss prevention now supports “sensitive content snippets”

Beta update: Data loss prevention rules based on classification labels are now applied instantly in Gmail on the web

Admins can now deploy Context-Aware Access for NotebookLM and NotebookLM Plus

Available in beta: Convert your client-side encrypted documents after a Vault or Takeout export

Consent re-confirmation for under 18 users accessing Additional Services will soon be required

Export your client-side encrypted documents to Microsoft Word files

The Policy API is now generally available with support for auditing more security features

Workspace data loss protection (DLP) for Gmail is now generally available

Data classification labels in Gmail are now available on all Android and iOS devices

Know who an event is shared with when using shared Google Calendars

Better understand app access with the new Access Evaluation log event

Filter by product

Filter by date

Subscribe by feed

Subscribe by email

Localized Google Workspace Updates

Useful Links

Join the official community for Google Workspace administrators

Learn about more Google Workspace launches