How to govern Google Workspace
A step-by-step guide to governing Google Workspace with Rencore: detect with 28 policies, review with 12 reports, and remediate with 5 automations.
Governing Google Workspace means keeping its access, configuration, and lifecycle under continuous control rather than reacting after something breaks. Rencore governs Google Workspace with 28 pre-built policies, 12 reports, and 5 automations, so teams can detect risk, review posture, and remediate with an audit trail. The steps below turn that coverage into a repeatable routine.
Steps
-
Inventory Google Workspace
Connect Google Workspace and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.
-
Detect with policies
Turn on the pre-built policies that cover Google Workspace to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.
-
Review by owner and severity
Use the Google Workspace reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.
-
Remediate and automate
Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.
Recommended Google Workspace policies
Grounded in the Rencore catalog. See the full Google Workspace catalog on the Google Workspace connector page.
-
Drive file reachable externally
Active Drive files shared outside the domain are externally reachable, raising the likelihood any weakness is exploited.
Severity: High -
Drive file reachable by anyone with the link
Active Drive files with anyone-with-link sharing are reachable without authentication, raising exploitation likelihood.
Severity: High -
User holds admin privileges
Active admin users have privileged, tenant-wide reach, raising the likelihood that any weakness has real-world impact.
Severity: High -
Shared Drive open to non-domain members
Shared Drives without the domain-users-only restriction are externally reachable, raising exploitation likelihood.
Severity: Medium -
Group reaches external members
Groups with external members forward distribution and shares outside the tenant, raising leak likelihood.
Severity: Medium -
Chat space allows external users
Chat spaces allowing external users are reachable from outside the tenant, raising leak likelihood.
Severity: Medium -
Drive file shared with anyone-with-link
Detects active Drive files where the link grants access to anyone (any internet user).
Severity: High -
Drive file shared outside the domain
Detects active Drive files with at least one permission granted to users outside the tenant domain.
Severity: High -
Shared Drive allows external members
Detects Shared Drives where the domain-users-only restriction is disabled.
Severity: High -
Google Group with external members
Detects Google groups with at least one member outside the tenant domain.
Severity: Medium -
Drive file shared with allUsers (publicly discoverable)
Detects active Drive files marked as discoverable to anyone on the internet.
Severity: Critical -
Super admin without 2-step verification
Detects active admins who are not enrolled in 2-step verification.
Severity: Critical
