Workspace's Admin Console (admin.google.com) is the heart of your tenant. Adding users, security policies, device management — all done from here. If the admin doesn't know it, the tenant can't be secure.
01. User Lifecycle
Accounts opening automatically for new staff, accounts closing automatically for departing staff — this should be connected to the organizational process. Manual management is unsustainable in the long run.
02. Mandatory 2FA
Enabling 2FA for all users is possible on Business Standard and above. If mandatory 2FA isn't active, the tenant isn't secure. A hardware key (YubiKey, etc.) is strongly recommended for the admin account.
03. Device Management
Devices accessing corporate data are managed with Endpoint Management. Screen lock, password complexity, remote wipe — all can be enforced centrally.
04. Audit Logs
Who did what, who shared which file and when, who logged in when — all in the Audit Log. Regular review is critical for detecting suspicious activity.
05. DLP and Vault
In Business Plus and Enterprise: DLP rules (blocking sensitive-data sharing) and Vault (an email + Drive archive for compliance). Necessary for data-protection and regulatory compliance.