What’s changing
In the Alert Center, admins will now be notified of select critical and sensitive changes made to their Google Workspace configurations. Specifically, we will issue an alert when any of the following events are surfaced in the audit log:
- Changes to the primary admin
- SSO profile added: when a third-party SSO profile has been added and enabled for your organization.
- SSO profile updated: when a third-party SSO profile has been updated for your organization.
- SSO profile deleted: when a third-party SSO profile has been deleted for your organization.
- Password reset for super admins: when a password was reset for a super admin account.
We plan to introduce alerts for more high risk actions over time — we will provide updates here once available.
Who’s impacted
Admins
Why it’s important
These additional intelligent alerts will closely monitor several sensitive actions, making it easier for admins to stay on top of high risk changes to their environment and potentially malicious actions being taken by bad actors.
For each alert, admins and super admins will receive an email notification with key information regarding the event. Once the alert is received, admins can use the security investigation tool to further investigate the incident.
Getting started
- Admins: Alerts and their associated email notifications are ON by default and cannot be turned off. Visit the Help Center to learn about configuring who should receive email alerts, the alert center and viewing alert details, and admin audit logs.
- End users: There is no end user impact.
Rollout pace
- Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on June 28, 2022
Availability
- Available to all Google Workspace customers, as well as legacy G Suite Basic and Business customers