Google Workspace Security Playbook for K-12 Schools (2026)

License legend

TAG	MEANING
FREE	Available on Education Fundamentals (or any edition). Do these first, before any upgrade lands.
PAID	Requires Google Workspace for Education Standard or Plus (Context-Aware Access, DLP, Security Center, advanced endpoint management). Licensed per user.
ADD-ON	A separate purchase on top of Education Plus (Chrome Enterprise Premium, Gemini Enterprise, Google Voice). Listed so nobody budgets for it by accident.
CEU	Requires Chrome Enterprise Upgrade on the Chromebook. Licensed per device, sold with the hardware, never on a Workspace quote. If a Chromebook shows as Provisioned in Devices > Chrome > Devices, it has CEU.

Quick rule: everything in Phase 2 and the DLP rows in Phase 3 are PAID. Nearly everything else is FREE or CEU.

Licensing trap: PAID features only enforce on users who hold the license. Education Standard/Plus is licensed by total student count and covers all users. A staff-only purchase leaves student OUs unprotected. Renewals require a student enrollment verification letter; keep the student license count at or above enrollment.

Before you start

Confirm the edition covers every user, students included

Why	See licensing trap above.
Where	Billing › Subscriptions
License	N/A

Split OUs: Staff and Students

Set to	Split OUs: `Staff` and `Students` (K-2, 3-5, 6-8, 9-12), plus Chromebook device OUs by building or cart
Why	Every policy below is applied per OU. Students and staff need different rules.
Where	Directory › Organizational units
License	FREE

Create a break-glass super admin

Set to	Create a break-glass super admin (security key, excluded from all CAA, credentials stored offline)
Why	A bad CAA rule locks admins out too.
Where	Directory › Users, then Account › Admin roles
License	FREE

Pick a pilot group

Set to	Pick a pilot group (a few IT staff + one grade band or building)
Why	Every phase goes to pilot first.
Where	Directory › Groups
License	FREE

Phase 0: Identity basics

Enforce 2-Step Verification for staff

Set to	Enforce 2-Step Verification for staff: check "Allow users to turn on 2-Step Verification", then Go to advanced settings > Enforcement > Turn on enforcement now > "Select allowed 2-step verification methods" = Only security key
Why	Stolen passwords are the #1 way accounts get taken over. Keys can't be phished. Passkeys count as security keys unless the Passkeys Restriction card limits them to hardware keys. Track enrollment first at Reporting > User reports > Security; enforcing before enrollment locks people out.
Where	Security › Authentication › 2-step verification
License	FREE

Do not enforce 2SV on students

Why	Students can't reliably hold a second factor. Device-only access (Phase 2) is their second factor.
Where	Same screen, scoped to Students OU
License	FREE

Google session length 12 to 24 hours (staff)

Set to	Google session length 12 to 24 hours (staff); Google default is 14 days
Why	Limits how long a stolen session cookie works. Shorter causes re-prompts on Mac login tools. Users must sign out and back in before a new length applies. Admin console sessions are fixed at 1 hour regardless.
Where	Security › Access and data control › Google session control
License	FREE

Mark student OUs as under 18

Why	Auto-restricts YouTube, Gemini, and other 18+ services. Does not turn off Sites, Groups, Blogger, or Remote Desktop; those still need explicit Off in Phase 3.
Where	Account › Account settings › Age-based access settings
License	FREE

Mark Staff OU as 18 or older

Why	K-12 organization types often default the root to under-18, which silently strips Gemini and YouTube from teachers.
Where	Same screen, scoped to Staff OU
License	FREE

Login challenges: employee ID for staff

Set to	Login challenges: enable employee ID challenge for Staff (only if the Employee ID field is populated and not on badges); leave off for Students unless the ID is something classmates don't know
Why	Challenges are always on; this only adds employee ID to the list Google can ask for. Student IDs are on lunch cards and rosters, so they add nothing.
Where	Security › Authentication › Login challenges
License	FREE

Phase 2: Context-Aware Access (CAA)

Everything in this phase is PAID. All CAA work lives at Security > Access and data control > Context-Aware Access. Two things first: click Turn On on that page (assignments do nothing until CAA is on; turning it off again takes up to 24 hours to fully clear), and have every staff user sign into Endpoint Verification and refresh their browser before any device policy goes active, or they get denied even on a compliant device.

Basic mode is enough for almost everything here. It offers these attributes: IP subnet, Location (countries), Device policy (admin approval required, company-owned required, screen lock, encryption), Device OS with a minimum version (macOS, Windows, Linux, ChromeOS, iOS, Android), and "meets an existing access level." Conditions can be joined with AND/OR, and a condition can be set to "Don't meet attributes" for deny lists. Advanced mode (CEL) is only needed for attributes Basic mode lacks, such as ChromeOS verified boot (device.verified_chrome_os == true). Never edit Workspace access levels from the Google Cloud console; it can inject unsupported attributes and block everyone.

Access levels to create

LEVEL	CONDITIONS	WHY
`US-Only`	Location = United States, optionally OR IP subnet (Public) = district VPN egress range	Almost all attacks on school accounts originate outside the US. Basic mode.
`Staff-Device`	Device policy: admin approval required + encrypted + screen lock; Device OS: Windows/macOS with minimum version	Stolen credentials are useless without a district laptop. Basic mode. Requires Device approvals on and laptops approved first.
`Staff-Mobile`	Device policy: screen lock + encrypted; Device OS: iOS/Android with minimum version	Blocks unmanaged phones, because an unmanaged phone reports none of these attributes. Basic mode. Do not add "admin approval required" unless the OU is on Advanced management; basic-managed phones can never be approved. Encryption and OS version can take days to sync after enrollment.
`Student-Device`	Device OS = ChromeOS with minimum version, plus company-owned required; add verified boot in Advanced mode (`device.verified_chrome_os == true`)	Students can only reach Google from a district Chromebook. Enrolled Chromebooks are company-owned automatically. Verified boot is CEL-only.
`Student-Mac` (only if Mac labs use a Google-backed login tool)	Same as Staff-Device, scoped to lab OU	Lab Macs would otherwise be blocked.
`Staff-Travel`	Same device conditions as Staff-Device, AND a second condition set to "Don't meet attributes" with Location = high-risk deny list	Travelers keep working; device requirement never drops. Basic mode handles the deny list.

Assignments

WHAT	WHY	WHERE
Combine `US-Only` AND the device level; assign to Gmail, Drive/Docs, Calendar, Meet, Chat, Keep, Sites, Tasks, Cloud Search, Vault, Gemini, Gemini Notebook, Workspace Studio, and the Admin console	Both conditions must be true. Assigning multiple levels to one app is an AND. Assign light apps first, Gmail last, per Google's rollout guidance.	Context-Aware Access > Assign access levels
Assign by group for travel, by OU for everything else	Group assignments override OU without moving the user.	Same
Apply only `US-Only` (never a device level) to any Mac login tool's OAuth app (Mosyle Auth, Jamf Connect, etc.), or exempt it entirely	A fresh Mac has no EV yet; a device rule would block first login. Google documents both assigning levels to third-party apps and exempting trusted ones.	Context-Aware Access > Assign access levels > Third-party apps
Monitor mode first, at least one week, pilot OU	See who would be denied before anyone actually is. Denials that would have happened appear in Context-Aware Access log events.	Each assignment > Monitor; Reporting > Audit and investigation > Context-Aware Access log events

Known limits (tell the help desk)

Geolocation is IP-based. Some carriers and home ISPs misplace users occasionally. Native mobile apps on an unapproved phone fail silently, no error. Third-party SAML/OAuth apps are only covered if you assign CAA to them explicitly.

Travel exception workflow

Staff submits travel dates and countries (form/ticket).
IT adds them to a travel-exception group, which carries Staff-Travel.
Auto-remove on return date (group membership expiration, or a short Apps Script).
Admins traveling use the break-glass procedure, not the travel group.
Loaner Chromebook for high-risk destinations; wipe on return.
No student travel exception. Student Chromebooks are simply blocked abroad.

Gate: zero unexpected denials in the CAA log during monitor week; break-glass tested; Mac login verified with 2SV on a freshly enrolled Mac; help desk briefed. If something goes wrong after activation, delete the offending access level rather than turning CAA off: deleted levels stop applying immediately, while Turn Off can take 24 hours.

Phase 3: Data protection

Both lanes

DLP rules with predefined detectors

Set to	DLP rules with predefined detectors (SSN, credit card, birthdate, address, credentials) on Drive and Chat
Why	Catches PII leaving the district automatically.
Where	Security › Access and data control › Data protection
License	PAID

Add CAA conditions to DLP rules

Set to	Add CAA conditions to DLP rules (block download/print/copy off approved devices)
Why	Closes the gap where a viewer on a personal machine could still export.
Where	Same › Rule › Conditions
License	PAID

Classification labels for Drive

Set to	Classification labels for Drive; use as DLP conditions, or let DLP apply them automatically
Why	Lets DLP target "Student Records" instead of scanning everything.
Where	Security › Access and data control › Classification labels (Label Manager); Apps › Drive and Docs › Labels to turn them on for users
License	PAID

Chrome DLP

Set to	Chrome DLP (upload/download/paste) on managed browsers
Why	Catches data leaving through the browser itself. Google: "features are available only for customers who have purchased Chrome Enterprise Premium." Skip unless budgeted.
Where	Security › Access and data control › Data protection (Chrome trigger) + Chrome Enterprise connector policies
License	ADD-ON (Chrome Enterprise Premium, not included in Education Plus)

Google Takeout

Set to	Google Takeout: shared control Not allowed (K-12 default), plus the individual per-service controls (YouTube and others default to Allowed) set to Not allowed for students; "Transfer your content" unchecked except for a graduating-seniors OU in spring
Why	Stops one-click export of an entire account. K-12 domains already have the shared control off, but the per-service Takeout controls default to Allowed and the graduating-student transfer tool is a separate checkbox on the same page.
Where	Data › Data import & export › Google Takeout › User access to Takeout for Google services; Additional transfer permissions
License	FREE

Block unconfigured third-party apps

Set to	Block unconfigured third-party apps; allowlist vetted apps only
Why	Rogue OAuth apps are a common data-theft path. Note: users labeled under 18 are already blocked from unconfigured apps by Google; the only choice for them is whether to allow apps that request basic Sign in with Google info only. Students then "request access," and requests show on the Admin console home App access control card.
Where	Security › Access and data control › API controls
License	FREE

Restrict Marketplace installs

Why	Same reason as above.
Where	Apps › Google Workspace Marketplace apps › Settings
License	FREE

Gmail: no external auto-forwarding, no POP/IMAP

Set to	Gmail: disable auto-forwarding to external, disable POP/IMAP
Why	Forwarding rules are the classic silent exfiltration.
Where	Apps › Google Workspace › Gmail › End user access
License	FREE

Gmail: enhanced scanning and external recipient warning

Set to	Gmail: enhanced pre-delivery scanning, external recipient warning
Why	Phishing and "oops, wrong recipient."
Where	Apps › Google Workspace › Gmail › Safety
License	FREE

Gmail: attachment compliance

Set to	Gmail: attachment compliance (see recipe below)
Why	Password-protected zips and disk images are how malware gets delivered; Google can't scan inside them. Google already rejects executables automatically.
Where	Apps › Google Workspace › Gmail › Compliance › Attachment compliance
License	FREE

Gmail: content compliance for SSNs and card numbers

Set to	Gmail: content compliance with predefined matchers (SSN, credit card) on outbound, Medium confidence, min match 1
Why	PII in the body or attachments. Belt to DLP's suspenders. Predefined matchers save but do nothing on Fundamentals.
Where	Apps › Google Workspace › Gmail › Compliance › Content compliance
License	PAID

Gmail: regex fallback for SSNs

Set to	Gmail: regex fallback for formatted SSNs (`\b\d{3}-\d{2}-\d{4}\b`) on outbound
Why	Works with no license dependency; noisier than predefined matchers.
Where	Same › Advanced content match › Body › Matches regex
License	FREE

Turn OFF Chrome Remote Desktop

Set to	Turn OFF Chrome Remote Desktop (service) for all OUs
Why	Lets anyone with the account remote-control a district device from anywhere, bypassing every device and location check.
Where	Apps › Additional Google services › Chrome Remote Desktop
License	FREE

Remote access on ChromeOS

Set to	Remote access on ChromeOS: Remote support connections = Prevent remote support connections; Remote access hosts and Remote access clients = district domains (one per line); Firewall traversal = Disable; leave Enterprise remote support connections allowed so IT can still connect from the Admin console
Why	Students can't start or accept a Chrome Remote Desktop session; personal accounts can't be on either end; IT's Admin-console remote support keeps working.
Where	Users & browsers › Remote access
License	FREE ( CEU on Chromebooks)

Recipe: Gmail attachment compliance rule

Path: Apps > Google Workspace > Gmail > Compliance > Attachment compliance > Add setting

FIELD	VALUE	WHY
Description	`Quarantine encrypted and risky inbound attachments`	Required field.
Email messages to affect	Inbound only	Quarantining outbound holds staff mail silently. Never quarantine outbound; use a separate Reject rule if needed.
Expressions (If ANY match)	File type > Office documents which are encrypted; Compressed files and archives which are encrypted	Google can't scan inside password-protected files.
Custom file types	`iso, img, vhd, vhdx, lnk, hta, js, jse, vbs, vbe, wsf, wsh, ps1, scr, bat, cmd, reg, msi, jar`	Runs when double-clicked but slips past the built-in executable filter. Disk images and .lnk shortcuts are current top phishing payloads.
Also match files based on file format	Checked	Catches renamed files.
Leave unchecked	Unencrypted Office docs, unencrypted archives, images, video, audio	Normal school traffic.
Action	Change Modify message to Quarantine message > Default quarantine	Lets IT release the legitimate ones.
Notify recipient	On for staff, off for students (split the rule per OU if you want both)	Staff can ask IT to release; students shouldn't.
After saving	Watch Apps > Gmail > Manage quarantines for the first week	Adjust the extension list if something legitimate keeps landing there.

Optional stricter student rule: same expressions plus Compressed files which are not encrypted, action Reject, scoped to Students OU. Students have no reason to receive zips from outside.

Recipe: auditing shared drives and public files

Shared drives outlive the people who made them, and their sharing settings are set per drive by whoever created it. A shared drive created in 2019 with "anyone with the link" enabled is still that way today.

Tenant-wide defaults (set once)

Path: Apps > Google Workspace > Drive and Docs > Sharing settings, then the Shared drive creation section

SETTING	VALUE	WHY
"Prevent users in [OU] from creating new shared drives"	Unchecked for Staff, checked for Students	Student-created shared drives are unmonitored group spaces.
Prevent members from sharing files outside the organization	Checked for Students; checked for Staff unless a specific drive needs external partners	Stops external sharing from a shared drive even if the user's own setting would allow it.
Prevent people who aren't shared drive members from accessing files	Checked	Blocks "anyone in the organization with the link" from reaching shared drive files they weren't given.
Prevent commenters and viewers from downloading, copying, and printing	Checked for Students; optional for Staff	Same control DLP applies, without the license.
Prevent content managers from changing shared drive settings	Checked	Only managers (and admins) can loosen the drive.

New drives inherit these; existing drives keep whatever they had, which is why the audit below matters.

Keep admins' daily-driver accounts out of sensitive drives. The account you read email and browse with all day is the one most likely to be phished, and anything it can open is what an attacker can download with a single stolen session. Put student records, HR, finance, and security documentation in shared drives whose members are a separate admin or role account per person, used only for that work, with no mail delivered to it. Your everyday account should not be a member at all. This cuts both exfiltration risk (the session an attacker is most likely to get can't reach the files) and attack surface (there is no "I'll just open it from my main account" path to misconfigure). The same split applies to super admin: the super admin role should live on an account nobody uses for daily work.

Per-drive audit (quarterly)

Fix drives with no active manager (creator left the district)

Set to	Fix drives with no active manager (creator left the district): add an IT manager, then reassign
Where	Same page › drive › Manage members
License	FREE

Restrict drives that still allow external or non-member access

Set to	Restrict settings on any drive that still allows external sharing or non-member access unless it has a documented reason
Where	Same page › drive › Settings
License	FREE

GAM export for a spreadsheet you can keep

Set to	GAM export for a spreadsheet you can keep: `gam print shareddrives fields id,name,createdtime,restrictions` and `gam print shareddrives ... showmembers`; diff against last quarter
Where	GAM
License	FREE

Find publicly shared files anywhere in the domain

Set to	Find publicly shared files anywhere in the domain: `gam all users print filelist query "visibility='anyoneWithLink' or visibility='anyoneCanFind'" fields id,name,owners,permissions` (add `select shareddriveid <id>` for a single shared drive)
Where	GAM
License	FREE

Same search, live, in Drive log events

Set to	Same search, live and filterable: Drive log events, filter Visibility = Public on the web or Anyone with the link
Where	Reporting › Audit and investigation › Drive log events
License	FREE to view

Bulk-remove public links from the investigation tool

Set to	Bulk-remove public links straight from the search results, and save the search as an alert rule
Where	Security › Security center › Investigation tool › Drive log events
License	PAID

Dashboard of external file exposure trends

Where	Security › Security center › Dashboard › File exposure
License	PAID

Alert rule: student external shares and public files

Set to	Alert rule: new externally shared file from a student, or any file set to Public on the web
Where	Security › Alert center › Rules
License	PAID

Remediation

Bulk-remove public and external permissions with GAM rather than by hand: gam user <owner> delete drivefileacl <fileid> anyone for a single file, or drive the same command from the export above. Announce before running it; teachers use "anyone with the link" for parent newsletters and will need a trusted-domain or specific-person share instead.

Recipe: detecting malicious mailbox filters

No admin setting prevents users from creating Gmail filters. Attackers use them to auto-archive password resets and invoices so a compromised account stays quiet.

External auto-forwarding off, delegation restricted, third-party OAuth blocked

Why	Removes the forward-to-attacker action and the API path for silent filter creation.
Where	Covered in Phase 3 rows above
License	FREE

Weekly GAM dump

Set to	Weekly GAM dump: `gam all users print filters`, `print forwards`, `print delegates`; diff against last week
Why	Most reliable detection. Flag delete/archive/mark-read/forward actions paired with terms like `password`, `verify`, `invoice`, `wire`, `payroll`, `direct deposit`.
Where	GAM, scheduled
License	FREE

Read Gmail log events for user settings changes

Set to	Read Gmail log events for user settings changes (filter, forwarding, delegation)
Why	Same data as the paid tool, no alerting. Entries appear within about an hour.
Where	Reporting › Audit and investigation › Gmail log events
License	FREE

Alert in real time on risky filter creation

Set to	Saved investigation-tool search on the same events, turned into an activity rule that alerts on filter creation with a forward or delete action
Why	Real-time instead of weekly.
Where	Security › Security center › Investigation tool › Gmail log events › Create activity rule
License	PAID

Remediate a compromised mailbox

Set to	Remediate: `gam user X delete filter <id>`, password reset, `gam user X deprovision` (revokes tokens and sessions), recheck forwards and delegates
Why	Filter removal alone leaves the attacker's session alive.
Where	GAM
License	FREE

Staff

DLP action for staff: warn, then block

Set to	DLP action: warn for 2 weeks, then block
Why	Lets staff learn before it bites.
Where	Data protection › Rule › Actions
License	PAID

Vault retention rules per district policy

Set to	Vault retention rules per district policy; holds enabled
Why	Legal and records requests.
Where	vault.google.com › Retention / Matters
License	FREE (included in Education Fundamentals)

Client-side encryption only when a key service is chosen

Why	Biggest lift; do last.
Where	Security › Access and data control › Client-side encryption
License	PAID

Students

DLP action for students: block

Set to	DLP action: block external sharing immediately
Why	Students won't read warnings.
Where	Data protection › Rule › Actions
License	PAID

Gmail internal-only + allowlist of approved external domains

Set to	Gmail internal-only + allowlist of approved external domains; no delegation
Why	Stops outside contact and spam.
Where	Apps › Google Workspace › Gmail › Compliance › Restrict delivery
License	FREE

Chat internal-only

Set to	Chat internal-only; external Meet joins blocked; Meet creation requires staff host (by grade band)
Why	Same.
Where	Apps › Google Workspace › Google Chat › External chat / Google Meet › Meet safety settings
License	FREE

Turn off services students don’t need

Set to	Turn OFF: Gemini, Play/Marketplace, Sites, Blogger, Groups, Photos, Maps sharing, Chrome Remote Desktop
Why	Not needed for instruction; each is a data path.
Where	Apps › Additional Google services (Students OU)
License	FREE

Classroom: verified teachers, staff-only classes

Set to	Classroom: teacher verification on, class creation staff-only, guardian summaries configured
Why	Prevents fake classes and keeps parents in the loop.
Where	Apps › Google Workspace › Classroom
License	FREE

Classroom API data access ("Users can authorize apps")

Set to	Classroom API data access ("Users can authorize apps"): leave checked for 3-12 and staff; uncheck only for K-2
Why	Unchecking breaks student-side integrations (Kami, Edpuzzle, Pear Deck, Nearpod, Classroom add-ons). Restrict which apps can get Classroom scopes in API controls instead: set the Classroom service to Restricted so only Trusted apps qualify.
Where	Apps › Google Workspace › Classroom › Data access; Security › Access and data control › API controls › Google services › Classroom
License	FREE

Vault: separate student retention

Set to	Vault: separate student retention; suspend at withdrawal, delete after retention window
Why	FERPA/COPPA and state retention rules.
Where	vault.google.com › Retention (Students OU)
License	FREE

Shorter sessions on shared carts

Set to	Session: shorter for cart/shared Chromebooks; sign out on lid close
Why	Next student shouldn't inherit the last one's session.
Where	Devices › Chrome › Settings › Device
License	CEU

Gate: DLP incident reports reviewed; no legitimate workflow blocked; Vault retention documented.

Phase 3a: Domain-wide delegation and service-account hygiene

Domain-wide delegation (DWD) lets a Google Cloud service account act as any user in the tenant without that user's consent or password. It is how backup products, mail-security connectors, directory syncs and in-house scripts read and write every mailbox and Drive. The list of delegated clients is the list of identities that can impersonate your whole organization, and it accumulates for years because nothing expires it and nothing reports on it. Every entry answers four questions: who owns it, what it actually does, whether it is still used, and what happens when the person who created it leaves.

Audit

Inventory the delegation page

Set to	Export every row — display name, client ID, scope list, and from your own records the owner and purpose. Push entries with no recognizable name, or a name that is a project rather than a product, to the top.
Why	The page is the only place the names live. Google's audit log records client IDs, not names, so the two have to be joined by hand. No API lists DWD clients.
Where	Security › Access and data control › API controls › Manage Domain Wide Delegation
License	FREE

Match each client to what it actually does

Set to	For each client ID, pull its token audit events: authorize events give the impersonated users, source IP and requested scopes; activity events give the API and method of every call. Record distinct users, calls per day, source IPs, first and last seen, and top methods.
Why	Scopes say what a client may do; methods say what it does. A backup reads history and change-list endpoints and never writes; a connector reading every mailbox from a cloud IP range you don't recognize is a different conversation.
Where	Reports API, activities.list with applicationName=token, userKey=all, filters="client_id==" (add eventName for methods); 180-day retention
License	FREE

Remove anything with no activity in the window

Set to	Zero token events in 180 days means remove the entry. Keep the exported row so it can be re-added in one step if a vendor calls.
Why	Dormant delegations are standing impersonation rights held by a key you probably can't locate, and nothing visible depends on them. They are the easiest removals in the tenant.
Where	Same page › delete; re-add by pasting client ID and scopes
License	FREE

Name every entry after the product and owner

Set to	"Backup NAS, building X, owner Y" rather than the name of the Cloud project someone reused. Rename on the page; the client ID doesn't change.
Why	The next admin has to be able to answer "what is this" from the page alone.
Where	Same page › edit
License	FREE

Minimize scopes to what the methods show

Set to	Compare the granted scopes with the APIs actually called. Drop write scopes where only reads occur, and unused "nice to have" scopes, unless the vendor's documentation requires them for discovery.
Why	A read-only backup that holds a user-write scope becomes an account-creation tool the day its key leaks.
Where	Same page › edit scopes; test the product afterward
License	FREE

Separate DWD from per-user OAuth apps

Set to	Integrations users consent to individually (copier scan-to-Drive, classroom tools, PDF editors) live under App access control, not here. Audit them with the same token-log method, filtered by app name.
Why	They don't impersonate the whole domain, but a Drive-write app used by 400 people is still a mass-exfiltration path if the vendor is breached.
Where	Security › Access and data control › API controls › Manage third-party app access
License	FREE

Ownership: keep projects, service accounts and keys away from daily drivers

Service-account projects are organization-owned

Set to	Every service account that holds a delegation sits in a Cloud project inside your Workspace organization, in a folder reserved for infrastructure. Project Owner and Editor are held by dedicated admin identities only — no personal Gmail, no vendor account, no former employee.
Why	Whoever owns the project can mint a new key that reads every mailbox the delegation covers. A project created under someone's daily account is orphaned the day they leave and keeps working for anyone who still has that account.
Where	console.cloud.google.com › IAM & Admin › IAM; organization folder structure
License	FREE

One key per consumer, with an expiry

Set to	Each product or script gets its own service account and exactly one key. Set the org policy iam.serviceAccountKeyExpiryHours so keys must be re-issued on a schedule (a year suits an appliance). Delete keys you can't name a consumer for.
Why	A shared key can't be rotated without an outage somewhere, so it never is. A no-expiry key downloaded to a laptop in 2019 is still valid.
Where	console.cloud.google.com › IAM & Admin › Service Accounts › Keys; Organization policies
License	FREE

Keys never touch a daily-driver machine or account

Set to	Download a key directly on the host that will use it (the appliance, the automation server) or into a secrets store — never into a Downloads folder, a mailbox, a chat, or a daily account's Drive. On servers, the key file's ACL names the one identity that reads it.
Why	The JSON key is the credential. The usual leak is a copy left where every local user, a backup job, or a transcript can read it — not a breach of the Cloud project.
Where	Host file-system ACLs; secrets manager
License	FREE

Vendor connectors run as a service identity, not a person

Set to	When a vendor product wants an admin account for its Google connector (mail security, SSO provisioning, archiving), create a dedicated identity with exactly the admin role it needs. Never a named admin, never the break-glass.
Why	The connector keeps running as that person after they change roles or leave, and its thousands of daily calls appear in the log under their name, hiding any real activity by that account.
Where	The vendor's admin portal; Directory › Users; Account › Admin roles
License	FREE

Google auto-provisioning runs as whoever enabled it

Set to	SAML app auto-provisioning is authorized under the admin who set it up and re-binds to whoever re-authorizes it. Authorize it from a dedicated provisioning admin, and re-authorize from that identity after admin turnover.
Why	It generates a steady stream of token events under that admin forever. If that was the break-glass account, the account that should be silent is the noisiest in the log.
Where	Apps › Web and mobile apps › (app) › Auto-provisioning
License	FREE

Break-glass accounts are silent and alerted on

Set to	No delegation, no provisioning job, no connector bound to the break-glass identity. An alert rule on any login or token event for it.
Why	The account's value is that any activity on it is an incident. A standing job under it removes that property.
Where	Security › Alert center › Rules; token-log review
License	FREE

Recipe: one delegation, start to finish

Read the row: name, client ID, scopes.
Token log, 30 days: distinct impersonated users, calls per day, source IPs, scopes actually requested.
Token log, activity events, 7 days: API and method names. Reads only, or writes?
First-seen probe: sample one-day windows at 180, 90, 60, 30 days back. Present at 180 means older than the log.
Admin audit, 180 days: AUTHORIZE_API_CLIENT_ACCESS and REMOVE_API_CLIENT_ACCESS name the admin who added or changed it, if it was in the window.
Match to a product by scope list and method pattern, then confirm with the owner or the vendor's docs.
Cloud Console: which project, which organization, who owns it, how many keys, created when.
Decide: keep as is, rename, trim scopes, re-key, or remove. Write the decision next to the row.

Gate: every row has a named owner and a one-line purpose; no row has zero events in 180 days; every service account's project is organization-owned; no key is older than the expiry policy; no connector or provisioning job runs as a person or the break-glass.

Gotchas

The display name is whatever someone typed. A project named after a dead product can be running your most important backup. Trust the method names, not the label. Dormant does not mean harmless. A delegation nobody uses is still a key somewhere nobody is watching. Remove it; re-adding takes a minute. Volume spikes after mass directory changes. Backup and sync products re-crawl permissions and history when thousands of users change OU or state. Check the product's own log before calling it an incident. A capped query lies about time. Reports API results are newest-first; 60,000 rows from a 7-day query can all be from this morning. Count per day in separate windows. Read-only scope variants may not be delegated. A key authorized for the read-write directory scope is refused the read-only scope. Request the scope that is actually listed. The person-shaped integration hides real activity. A connector making 800 calls a day as a named admin means a real login by that admin is one line in a thousand. Move it off the person before you build alerts. Keys in transcripts. Any tool that prints a file to a log, a chat, or an AI session has copied the key. Treat a key that has been displayed as burned, and rotate it.

Phase 3b: Student misuse controls

These close the tricks students use to bypass filters, hide activity, cheat, or harass. Almost all are Chrome user/browser policies applied to the Students OU under Devices > Chrome > Settings > Users & browsers, so they follow the student account on any enrolled device.

Filter and monitoring bypass

Google Lens: all five policies off

Set to	Google Lens: Disabled across all five Lens policies (see recipe below)
Why	Lens screenshots a page and searches it, which turns any image, PDF, or blocked page into a search box that filters can't see. The fastest cheating tool on a Chromebook.
Where	Users & browsers › search "Lens" (Overlay, region search, camera assisted search, Gallery integration, New Tab button)
License	CEU

Google Translate

Set to	Google Translate: block `*.translate.goog` and `translate.googleusercontent.com` only; keep `translate.google.com` and the Chrome translate bar on
Why	The website-translation proxy runs on translate.goog, not on the app's domain. Blocking the app breaks ELL students and world-language classes for no security gain. The in-page translate bar never proxies; locked mode disables it for quizzes.
Where	Users & browsers › Content › URL blocking
License	CEU

Cached pages, AMP, and web archives

Set to	Cached pages, AMP, and web archives: block exactly `webcache.googleusercontent.com`, `web.archive.org`, `*.ampproject.org` (students only)
Why	Same proxy trick. Google's cache is retired, so that entry is near-zero risk, but never widen it: `*.googleusercontent.com` breaks Docs images, Drive, Sites, and Apps Script. Leave `web.archive.org` open for staff; teachers use it for research.
Where	Users & browsers › Content › URL blocking
License	CEU

Incognito mode

Set to	Incognito mode: Disallow incognito mode (already the K-12 default; confirm it); Browser history: Always save; Clear browser history: Do not allow
Why	No activity should be invisible to monitoring tools. Chrome won't close Incognito windows already open, so the policy lands on the next restart.
Where	Users & browsers › Security › Incognito mode / Browser history / Clear browser history
License	CEU

Sign-in to secondary accounts

Set to	Sign-in to secondary accounts: Block users from signing in to or out of secondary Google Accounts
Why	A personal Google account added in-session bypasses every OU setting. This is the ChromeOS in-session control; the device-level Sign-in restriction covers the login screen.
Where	Users & browsers › Sign-in settings › Sign-in to secondary accounts
License	CEU

Automatic sign-out across devices

Set to	Automatic sign-out across devices: Automatically sign out user from previous device
Why	One account on one Chromebook at a time. Google's own description names the school use case: stops shared credentials for collaboration and cheating on graded work.
Where	Users & browsers › Sign-in settings › Automatic sign-out across devices
License	CEU

Developer tools off, chrome:// pages blocked

Set to	Developer tools: Never allow; block `chrome://flags`, `chrome://policy`, `chrome://extensions`, `chrome://settings/*` as needed
Why	Dev tools and flags are how students disable extensions and rewrite page content.
Where	Users & browsers › User experience › Developer tools; URL blocking
License	CEU

Extensions: allowlist only

Set to	Extensions: allowlist only; block installs from outside the list. Add the web filter's and classroom-monitoring extension IDs to the allowlist and force-install list first
Why	VPN and proxy extensions are the #1 filter bypass. Flipping to allowlist-only without the filter's ID removes the filter.
Where	Devices › Chrome › Apps & extensions › Users & browsers › Additional settings
License	CEU

Force SafeSearch; YouTube Restricted Mode via Chrome policy

Set to	Force SafeSearch; YouTube Restricted Mode via Chrome policy: At least Moderate for all student OUs, Do not enforce for staff
Why	Browser-level header on every YouTube request, signed in or not; the backstop if the filter extension crashes. Strict hides a lot of legitimate educational video, and layered restrictions (Chrome header + GoGuardian + DNS restrict.youtube.com) resolve to the strictest, so keep Chrome at Moderate and let the web filter carry Strict and any per-class or time-based exceptions. One source of truth per job.
Where	Users & browsers › Content › SafeSearch and Restricted Mode
License	CEU

YouTube account setting

Set to	YouTube account setting: Strict + approved videos for K-8 (teachers as approvers), Moderate for 9-12, Unrestricted for staff
Why	Account-level control that follows the student. Approved videos let teachers whitelist specific content. If the Chrome policy is Strict, it overrides approvals, so keep the Chrome policy at Moderate for any OU that relies on approved videos. Test one approved video as a student before rollout.
Where	Apps › Additional Google services › YouTube › Content settings / Permissions
License	FREE

Safe Browsing Protection Level

Set to	Safe Browsing Protection Level: Standard for students, Enhanced for staff; users can't override warnings; never "user decides" or "never active"
Why	Standard checks URLs against threat lists with privacy-preserving hashing. Enhanced sends full URLs, page snippets, and downloads to Google tied to the account, which is a student-data-privacy question for minors but a clear win for staff, who are the phishing targets.
Where	Users & browsers › Security › Safe Browsing
License	CEU

Local file blocking

Set to	Local file blocking: in the web filter (GoGuardian, Securly, etc.), block `file:////downloads/.html`, `.mhtml`, `.mp4`, `.mkv`, `.mp3` and `file:///media/removable/.html`, `.mhtml`; in the Chrome URL blocklist, add `file:///media/removable/` as a plain prefix
Why	A downloaded games hub or saved page opens from Downloads as a local file where no filter sees a request; downloaded video sidesteps YouTube Restricted Mode. The filter's matcher supports wildcards anywhere in the URL; Chrome's URL blocklist only wildcards the host and prefix-matches the path, so it cannot match by file extension, and the ChromeOS Downloads path contains a per-user hash that can't be prefixed. The removable-media prefix is the one part Chrome policy can hold on its own.
Where	Web filter rules; Users & browsers › Content › URL blocking
License	CEU FILTER

Google Apps Script

Set to	Google Apps Script: Off for students
Why	Students deploy Apps Script web apps as game launchers and proxies on script.googleusercontent.com, a Google domain filters trust. Removing the service is more durable than any detector.
Where	Apps › Google Workspace › Service status › Apps Script (it became a core service in June 2026 and may not yet appear in the sidebar or under Additional Google services; use Service status or the Admin console search box). If absent, API controls blocking unconfigured apps is a partial stopgap; the anti-evasion extension's Apps Script inspector covers the rest.
License	FREE

Force-install an anti-evasion extension

Set to	Force-install an anti-evasion extension (e.g., You Shall Not Pass by TeacherMagic.org, free) alongside the network filter
Why	Blocks proxy frameworks (Ultraviolet, Scramjet, Rammerhead), Google Sites game hubs, tab spam, and history-flood attacks the network filter can't see. One layer, not a replacement.
Where	Devices › Chrome › Apps & extensions › Users & browsers › Add from Chrome Web Store, Force install; https://chromewebstore.google.com/detail/you-shall-not-pass-by-tea/efggnkbeomjjanjmghbadggegjemogee
License	CEU

YSNP: Strict Sites and managed config

Set to	If using YSNP: enable Strict Sites mode and host a managed config JSON before rollout
Why	Default-deny iframe allowlist on Google Sites defeats obfuscation; the managed config is the kill switch for false positives without waiting on a store release.
Where	Extension policy in Apps & extensions; district-hosted JSON
License	CEU

Task manager

Set to	Task manager: Block users from ending processes with the Chrome task manager
Why	Killing the filter extension's process disables it. Users can still open the task manager; End process is dimmed.
Where	Users & browsers › Apps and extensions section › Task manager
License	CEU

Optional: stop students from changing their own passwords

Use these only if the district sets student passwords (for example, synced from the SIS). If students manage their own passwords by policy, skip this block.

Block the password-change pages

Set to	URL blocklist: `myaccount.google.com/signinoptions` and `myaccount.google.com/smartlink/password` (Students OU)
Why	Blocks the Google Account password-change page, and the passkey pages beneath `/signinoptions`. Limits: only works in managed Chrome; does not touch the "Forgot password?" flow; does not undo passwords already changed. The `/signinoptions` prefix match is not documented by Google, so verify with a test student that `/signinoptions/password` is blocked.
Where	Devices › Chrome › Settings › Users & browsers › Content › URL blocking
License	CEU

Passkey sign-in

Set to	Passkey sign-in: Off for Students ("Allow users to skip their password and authenticate with a passkey" unchecked). Google default is Off, so confirm it is inherited rather than overriding.
Why	Otherwise a student can add a passkey and bypass the SIS-set password. Does not apply if students sign in through a third-party IdP. If Staff go passwordless with security keys, turn it on as a Staff OU override, never at root. The Passkeys Restriction card on the same page ("hardware security keys only") is the Staff enforcement for key-only 2SV; enable it only after User reports > Security shows every staff key enrolled.
Where	Security › Authentication › Passwordless › Skip passwords card
License	FREE

Self-service account recovery

Set to	Self-service account recovery: Off for Students ("Allow users and non-super admins to recover their account" unchecked)
Why	Closes the reset-by-recovery-phone path. Google notes this setting does not apply when SSO or Password Sync is in use.
Where	Security › Authentication › Account recovery
License	FREE

Recipe: disabling Google Lens (and the settings that go with it)

Lens is not one setting. In the Admin console it is five separate Chrome policies, and a sixth surface (the website) that no policy covers. Search "Lens" in Users & browsers settings with the Students OU selected and set all five; missing one leaves an entry point.

Path: Devices > Chrome > Settings > Users & browsers > select the Students OU (and any assessment OU) > search "Lens"

SETTING	VALUE	WHAT IT CLOSES
Google Lens Overlay	Do not allow Google Lens overlay	The address-bar and side-panel Lens that screenshots the current page. This is the main cheating entry point.
Google Lens region search	Disable Google Lens region search	Right-click > "Search with Google Lens" on any image or selected region.
Google Lens camera assisted search	Do not allow enterprise user to use Google Lens camera assisted search	Pointing the Chromebook camera at a worksheet from the Lens shortcut.
Lens Gallery App integration	Disable Lens integration (user override not allowed)	The Lens button inside the ChromeOS Gallery app, which handles downloaded images and PDFs.
New Tab page Google Lens button	Do not show the Google Lens button in the search box on the New Tab page	The camera icon in the new-tab search box.
URL blocklist: `lens.google.com`, `images.google.com/searchbyimage`	Add	Lens is also a website. The browser policy doesn't block the site.
Camera app on ChromeOS	Block during assessments via a kiosk or locked-mode OU; otherwise leave on	The ChromeOS Camera app can scan text and QR codes. Only worth blocking in an assessment OU, since teachers use it for projects.
Quick Answers	Disabled	Highlighting a word on ChromeOS pops up definitions, translations, and unit conversions without opening a tab. Same cheating surface as Lens, smaller. Users & browsers > Content > Quick Answers.
Side search / Google side panel	Disabled	Lets a student search without leaving the assessment tab. Users & browsers > User experience > Side search.
Default search context menu ("Search Google for ...")	Disabled	Highlight a question, right-click, get the answer. Users & browsers > Content > Default search provider context menu.
Screenshots	Disabled for assessment OUs	Students screenshot a test to share, or to feed to an AI on a phone. Users & browsers > Content > Screenshot.
Google Forms locked mode	On for quizzes on managed Chromebooks	Locks the quiz to one tab, blocks extensions, and Google turns off Lens, Translate, and side panel automatically for that session. Teacher-side setting in Forms; requires enrolled Chromebooks.

Notes:

Web filter interplay. None of the Chrome policies in this phase conflict with GoGuardian, Securly, Lightspeed, or iBoss; most of them protect the filter extension. Two exceptions: the Screenshots policy breaks classroom screen monitoring, and the extension allowlist must include the filter before enforcement. For YouTube, three layers can stack (Chrome header, filter policy, DNS restrict.youtube.com); the strictest wins and teacher-approved videos fail silently, so pick one layer to carry Strict. Apply Lens Disabled to the whole Students OU, not just an assessment OU. Students use it to solve homework at home just as easily. Third-party AI and homework-answer sites (photo-solver apps, answer aggregators) are the same threat outside Google; block the "Generative AI" and "Academic dishonesty" categories in the web filter. Staff keep Lens. It's a legitimate accessibility and research tool.

Appendix: Additional Google services checklist for the Students OU

Path: Apps > Additional Google services, with the Students OU selected. Every service showing "Inherited" is taking the root setting; set explicit overrides here so staff are unaffected. Anything left On for students requires annual parental-consent reconfirmation in this same list (Google turns it off for under-18 users if you don't), so a short On list is also less yearly work. Google Apps Script is not in this list; it became a core service in June 2026 and is managed from Apps > Google Workspace > Service status (it may not yet show in the sidebar on every tenant). Set it Off for students.

SERVICE	STUDENTS	WHY
Google Cloud Platform	Off	Free-tier VMs and Cloud Run are where students host proxies. The single most important one in this list.
Colab	Off (allow a CS OU if needed)	Arbitrary code with outbound network; tunnels and proxies run fine from a notebook.
AI Studio	Off	Gemini API playground. Belongs with the Phase 3c AI shutoff.
Chrome Web Store	Off	Students are on an extension allowlist anyway; this removes the browse-and-request surface. Force-installed extensions still update via policy.
Google Play, Managed Google Play	Off	Matches the Play Store Off Chrome policy.
Messages by Google	Off	Texting from a Chromebook via messages.google.com.
Google Photos, Blogger, Google Groups	Off	Publishing and messaging surfaces with weak monitoring.
Early Access Apps	Off	New Google products appear for students before review.
Google Pay, Google Fi, Brand Accounts, Google Domains, Business Profile Manager	Off	No student use case.
Google Ads, Ad Manager, Campaign Manager, Merchant Center, Search Console, Programmable Search Engine, Play Console, Play Books Partner Center, Partner Dash, FeedBurner, Google Analytics, Tag Manager, Search Ads 360	Off	Advertiser and publisher tools; no K-12 student use.
Google Developers, Material Gallery, Pinpoint, Google Alerts, Google Bookmarks, Question Hub, Studio, Tables	Off	Low risk, no use. Shrinks the surface.
Scholar Profiles	Off	Creates a public academic profile page under the student's name. Privacy exposure, no K-12 use. Google Scholar search itself stays on.
Search and Assistant	Off	Signs students out of Search personalization, disables Google Assistant on Chromebooks, and removes account-tied AI Mode and search history. Search still works as a signed-out service.
Socratic	Off	Photo-a-homework-question solver.
Timeline	Off	Maps location history. Data collection, not a feature.
Data Studio (Looker Studio)	Off unless a data or business class uses it	Judgment call.
Chrome Remote Desktop	Off	Covered in Phase 3.
Web & App Activity, Location History	Off	Data-collection settings, not features.
Third-party app backups	Off	Lets non-Google apps (WhatsApp, some Android apps) store hidden backups in the account's storage. Not an attack surface; it's invisible storage use and personal app data in a district account that no admin tool can retrieve. Low priority.
YouTube	Configure per the Restricted Mode rows in Phase 3b	Do not leave inherited.
Google Maps, My Maps, Google Earth, Arts and Culture, Google Books, Google News, Public Data, Google Scholar	On	Instructional.
Google Translate	On	ELL and world-language classes; the proxy is blocked separately by hostname.
Chrome Canvas, Chrome Cursive, Applied Digital Skills, CS First	On	Harmless or Google's own curriculum.

What you can do today, before any upgrade

All FREE and CEU items from Phases 0, 1, 3, 3b, 3c, and 4. In rough priority order:

OU restructure, break-glass admin, staff 2SV with keys
Age-based access, Chrome Remote Desktop off, Takeout off
Student Chrome policies (Lens, Translate, Incognito, multiple sign-in, dev tools, extensions allowlist) and the Phase 3c AI shutoff
API controls (trust MDM first), Marketplace restriction
Gmail forwarding/POP/IMAP off, safety settings, attachment compliance, student restrict-delivery
Drive sharing settings for both lanes
Basic mobile management + Device approvals
Endpoint Verification pushed to laptops (ready for CAA on day one)
Vault retention rules

When the upgrade lands, Phase 2 and the DLP rows are the only new work.

Rollout order

Pilot (IT + one grade band or building) > Staff > 9-12 > 6-8 > 3-5 > K-2

Each step waits for the previous step's gate. If Chromebook device OUs are already per building or cart, staging by building is an equally good alternative to grade band.

Staff vs. Students at a glance

	STAFF	STUDENTS
2SV	Required, keys/passkeys only	Not enforced
Device definition	EV + admin-approved (laptops); Basic management (phones)	Enrolled ChromeOS only
External Drive sharing	Trusted domains	Off
Gmail scope	Open, forwarding blocked	Internal + allowlist
Chat / Meet	Open	Internal only (off for K-5)
DLP action	Warn, then block	Block
Gemini / AI features	Allowlisted	Off
Google Lens / Translate / Incognito	Allowed	Blocked
Third-party apps / extensions	Allowlisted	Allowlisted, stricter
Chrome Remote Desktop	Off (IT OU excepted)	Off
Travel	Group exception	Blocked abroad
Retention	District policy	Student-specific, deprovision on exit

Mac login tools (Mosyle Auth, Jamf Connect, similar)

If Macs sign in through a Google-backed login tool, check these before enforcing anything above:

The tool's OAuth clients (login + directory sync) marked Trusted in API controls
MDM deploys Chrome, EV extension, and EV native helper to every Mac
Only US-Only assigned to the tool's OAuth app in CAA (no device level)
2SV with security keys tested at the Mac login window; TOTP/Google prompt fallback allowed if keys fail there
Session length at least 12h to avoid unlock re-prompts

Admin console paths move between redesigns. If one is wrong, open an issue or PR.

Jim Tyler · MAEDS 2026 · An independent project, written and published on my own time. Free to use and share. Admin console paths, Group Policy paths and scanner rule names move between releases; if one is wrong, tell me.

Set to	Confirm Endpoint Verification is on (it is on by default): "Collect device signals using endpoint verification" checked
Why	This is how Google sees a laptop's encryption, screen lock, and OS version. Supported on Windows 10/11, macOS, ChromeOS 110+, Linux; requires Chrome.
Where	Devices › Mobile & endpoints › Settings › Universal › Data access › Device signals
License	FREE to install; PAID to use in CAA

Set to	Force-install the Endpoint Verification extension for the Staff OU; push Chrome itself via MDM (Macs) or Chrome Browser Cloud Management (Windows)
Why	EV must be present before the user's first login or CAA denies them.
Where	Devices › Chrome › Apps & extensions › Users & browsers › Add from Chrome Web Store › Endpoint Verification › Force install
License	FREE

Set to	Turn on Device approvals ("Require admin approval"), notification email to an IT group, then approve district laptops in the approvals list
Why	"Approved" is the cleanest "ours vs. not ours" signal. Blocking an EV device does not stop it syncing on its own; the CAA level must require approved status, which is why Phase 2 checks "admin-approved." Company-owned devices registered by serial number are auto-approved.
Where	Devices › Mobile & endpoints › Settings › Universal › Security › Device approvals; then Devices › Mobile & endpoints › Device approvals
License	FREE

Set to	Mobile management = Basic for Staff OU
Why	No profile or app on personal phones. Google enforces screen lock and can sign the account out remotely, and CAA can use basic-managed status, OS version, and encryption (those two can take days to sync after enrollment).
Where	Devices › Mobile & endpoints › Settings › Universal › General › Mobile management
License	FREE

Set to	Device approvals for phones: not available under Basic management (Android and iOS approvals require Advanced management). Choose: Basic + a CAA "managed device" condition (no per-phone approval), or Advanced with a work profile for approvals
Why	Google's requirement, not a setting. Basic management still lets CAA block unmanaged phones, which is the outcome that matters; you just won't get a Pending/Approve queue for personal phones.
Where	Devices › Mobile & endpoints › Settings › Universal › Security › Device approvals (Advanced only)
License	FREE

Why	Old phones stop carrying district mail.
Where	Same Universal settings › Security
License	FREE

Set to	Advanced mobile management for district-owned phones only (optional)
Why	Adds encryption, OS version, and compromised-device checks to CAA.
Where	Same › Mobile management, scoped to a district-phone OU
License	PAID

Why	Enrolled ChromeOS passes CAA device checks natively, no EV needed.
Where	Devices › Chrome › Devices
License	CEU

Set to	Forced re-enrollment = "Force device to automatically re-enroll after wiping" (this also disables developer mode); Powerwash = "Do not allow"; Verified access on; Guest mode = Disable (K-12 default)
Why	Prevents un-enrolling or wiping the device to escape policy. There is no separate developer-mode switch; forced re-enrollment is it.
Where	Devices › Chrome › Settings › Device settings › Enrollment and access; Sign-in settings
License	CEU

Why	Keeps personal Gmail off district hardware.
Where	Devices › Chrome › Settings › Device › Sign-in restriction
License	CEU

Why	CIPA and basic safety.
Where	Devices › Chrome › Apps & extensions
License	CEU

Set to	Readiness check before CAA: clear "OS version not compliant" and "Policies can't be applied" tiles; push pending updates; retire devices past Auto Update Expiration
Why	Those devices fail minimum-OS and verified-boot conditions the day CAA is enforced.
Where	Devices › Chrome › Devices (notification tiles at top; View upgrades for license count)
License	CEU

Why	Otherwise Mac logins and user sync stop.
Where	Same › Manage third-party app access
License	FREE

Set to	List every shared drive with member count, external members, and its four sharing settings; sort by external members and by "anyone with link" allowed
Where	Apps › Google Workspace › Drive and Docs › Manage shared drives (filter: has external members; no members; created by a suspended user)
License	FREE

Set to	Built-in alerts: suspicious login, email forwarding out of domain
Why	Catches the takeover that precedes the filter.
Where	Security › Alert center
License	FREE

Set to	Drive external sharing = allowlisted (trusted) domains only; no "anyone with link"
Why	Prevents accidental public documents. For finer control (this OU can share with these domains, that OU can't), use Drive trust rules instead of the OU-wide setting.
Where	Apps › Google Workspace › Drive and Docs › Sharing settings; Security › Rules › Trust rules for Drive sharing
License	FREE

Set to	Drive sharing within domain only; no link sharing; Drive for desktop off
Why	Student work stays inside the district.
Where	Apps › Google Workspace › Drive and Docs › Sharing settings (Students OU)
License	FREE

Set to	Off: no conversation sharing by public link or Drive; "Allow people to share Gems from the Gemini app" off. Set it even with the Gemini app off, so it is already closed if Gemini is turned on for a grade
Where	Generative AI › Gemini app › Sharing (Students OU)
License	FREE

Set to	Off: "Allow temporary chats" and "Allow users to delete conversations" both unchecked. Temporary chats skip Gemini Apps Activity, and deletion erases evidence after a cheating or safety incident. For records you can produce, add a Vault retention rule for Gemini; Vault keeps data regardless of user deletions
Where	Generative AI › Gemini app › Gemini conversation management (Students OU)
License	FREE

Set to	Off per app
Where	Generative AI › Gemini in Workspace (Students OU)
License	FREE (Plus controls each app separately)