Google Workspace security settings a small team needs
Google’s own Google Workspace security checklist for businesses of 1 to 100 users starts with accounts: enforce 2-Step Verification for administrators and key users, keep a second super administrator, and never stay signed in as one. Then come Gmail protections and limits on what Calendar and Drive share outside the company. Google wrote the list for teams without a dedicated IT administrator.
Google Workspace security best practices for a small team
Turn on 2-Step Verification for everyone, starting with administrators, then set up two super administrators who use separate accounts for daily work. Those two steps cover the top of Google’s security checklist for small businesses, written for teams of up to 100 people with no dedicated IT administrator. This page applies it as part of account security for small businesses, in order of priority.
All paths start in the Google Admin console and are those Google published as of November 2026. Google renames menus from time to time; the help page linked in each step has the current path.
Step 1: enforce 2-Step Verification
- Go to Menu, Security, Authentication, 2-step verification (super administrator required).
- Check Allow users to turn on 2-Step Verification.
- Under Enforcement, choose On, or Turn on enforcement from date; Google says enforcement starts 24 to 48 hours after the chosen date.
- Set the New user enrollment period, from one day to six months. During that time, a new user can sign in with a password alone, so keep it short.
Google’s 2-Step Verification guide offers three levels of enforced methods: any method; any method except codes by text or phone call; or only security keys, which now also accepts passkeys. Google calls security keys the strongest method and discourages text messages. Track who has enrolled under Menu, Reporting, User Reports, Security.
Step 2: let people use passkeys
Under Menu, Security, Authentication, Passwordless, Skip passwords, check the box that lets users skip their password and sign in with a passkey. Each user then adds a passkey. Two details from Google: the existing password is not removed, and a passkey alone does not turn on 2-Step Verification.
Step 3: set up your super administrators
Google’s best practices for administrator accounts come down to five rules:
- have more than one super administrator, each managed by a different person;
- give each of them two accounts, one for administration and one for daily work, such as admin-maria@ and maria@;
- never stay signed in as a super administrator;
- never share an administrator account, or the audit log cannot tell who did what;
- give each super administrator two security keys and a set of backup codes.
Google’s Advanced Protection Program goes further for super administrators and other likely targets: it requires security keys or passkeys and blocks risky third-party apps unless you approve them.
Then check Menu, Security, Authentication, Account recovery, Super admin account recovery. Google’s pages disagree on the default, which depends on your edition, so look at the setting rather than assume it. If a super administrator is ever locked out, Google may ask you to prove you own the domain through its DNS records: keep your domain registrar’s login safe, and not only in one person’s head.
Step 4: Gmail, Calendar, and Drive
The rest of Google’s checklist protects data rather than sign-ins:
| Service | Setting Google recommends |
|---|---|
| Gmail | Enhanced pre-delivery message scanning, extra protection against risky attachments and links, and an SPF record for your domain |
| Calendar | External sharing limited to free/busy information |
| Drive | Link sharing off by default, and a warning before someone shares a file outside the company |
What Business editions do not include
Two limits are worth knowing before you search for a missing menu. As of November 2026, the security dashboard and the security health page are listed only for Frontline, Enterprise, Education, and Enterprise Essentials Plus editions, not for Business Starter, Standard, or Plus. The alert center, under Menu, Security, Alert center, is there, though its investigation tool is reserved for Enterprise editions.
Google is also making 2-Step Verification mandatory for administrators, gradually, “over the coming years”; no date had been set for Business editions on November 10, 2026. You do not need to wait for it.
The Microsoft side
If your business runs on Outlook and Teams instead, the equivalent settings are called security defaults. See the Microsoft 365 settings for a small business.
One address, several people
Google offers delegation, collaborative inboxes, and, in some editions, a shared inbox. Our page on sharing an inbox without sharing a password compares them.
Suspend or delete?
A suspended account is still billed, and a deleted one can be restored for 20 days. See what to do when someone leaves before choosing.