Aegis Eight

← Resources

Five Common Essentials Drifts in Google Workspace Tenants

Typical Google Workspace configuration changes that can drop Essentials maturity — Super Admin sprawl, MFA regressions, Chrome/device gaps, Vault/backup drift, and domain-wide delegation hygiene.

You assessed a Google Workspace customer in March and claimed ML2. By June, their cyber insurance questionnaire or board pack asks for updated Essentials evidence — and the numbers no longer match. Usually nothing "broke" in a dramatic way. Someone changed an Admin Console setting during normal IT work, and maturity quietly slipped.

Configuration drift is silent. Google Admin does not email you every time an MFA enforcement group loses members. A new Super Admin can be created in minutes. Chrome policies and device management states can regress without anyone updating the spreadsheet from last quarter.

These five scenarios are common in Google Workspace tenants assessed against ASD Essentials. Each covers what happened, which strategies drop, why insurers and assessors care, and how to catch it early. For the Microsoft 365 twin of this article, see Five Common Essentials Drifts in Microsoft 365 Tenants.

How drift interacts with the weakest-link rule

Overall Essentials maturity is the lowest level across all eight strategies. One control slipping from ML2 to ML1 drops your entire claimed level to ML1 — even if everything else still looks fine. That rule is the same on Google Workspace as on Microsoft 365; only the API signals differ.

1. New Super Admin (or delegated admin) without strong MFA

What happened: Vendor onboarding, break-glass setup, or a new hire needed elevated access. Someone assigned Super Admin — or a broad admin role — to an account that is not covered by org-unit MFA enforcement, or that still allows weaker second factors.

Strategies affected: Restrict administrative privileges · Multi-factor authentication

Why it matters: Super Admins can change every Workspace control that Essentials cares about, including MFA and device policies. Under the November 2023 maturity model, privileged accounts without appropriate MFA and separation fail ML2 on both strategies.

Detect early: Alert on new Super Admin / privileged role assignment. Re-scan MFA coverage for admin users daily — not only at audit time. Review Google permissions for the read-only scopes that surface these signals.

2. MFA enforcement narrowed or exceptions expanded

What happened: A login failure during an executive demo led someone to exclude an org unit, group, or account from 2-Step Verification enforcement "temporarily." The exclusion never got reversed.

Strategy affected: Multi-factor authentication

Why it matters: Assessors and insurers ask whether MFA is enforced, not merely available. Registration without enforcement is a classic ML1/ML2 gap. A single exclusion group can hollow out coverage while the Admin Console still looks like "2SV is on" at a high level.

Detect early: Diff MFA-related settings and enforced groups on every scan. Treat any broadening of exclusions as material drift, even if overall policy text is unchanged.

3. Chrome / device posture gaps after MDM or OU changes

What happened: Devices were moved between organisational units, Chrome Management policies were loosened for a pilot fleet, or Windows/macOS endpoints never entered a managed path. Patch and application-hardening scores fell even though identity controls still looked strong.

Strategies affected: Patch applications · Patch operating systems · User application hardening · Application control (where Chrome / Workspace signals apply)

Why it matters: Google Workspace often scores MFA and admin privilege strategies well via Admin SDK and audit APIs, while desktop Windows/macOS patch status may show as no visibility without a third-party MDM. Moving users into weakly managed OUs makes that honesty visible on the report — which is correct, but it surprises teams who assumed "Workspace = fully scored."

Detect early: Track device and Chrome policy signals per OU. Treat "no visibility" expansions as a board-visible risk, not a tooling quirk. See our Google coverage notes and permissions.

4. Vault / backup retention drifted during license or cost changes

What happened: Google Vault licenses were reduced, retention rules shortened, or a third-party backup was paused. "Regular backups" looked fine in the last QBR PDF and fails today.

Strategy affected: Regular backups

Why it matters: Essentials cares whether recoverable retention actually exists for the estate you claim. Vault-dependent postures fail when licensing or rules change without updating the evidence story. Hybrid setups that rely on a third-party backup product have the same problem when that product's connection drops.

Detect early: Include Vault / backup configuration in continuous scans. Alert when retention windows shrink or backup integration signals disappear.

5. Domain-wide delegation (DWD) sprawl or forgotten service accounts

What happened: A historical integration still has broad DWD scopes. A temporary project leftover remains authorised. The Essentials assessment path itself may look fine while the tenant's DWD footprint grows risk for privilege and application control stories.

Strategies affected: Restrict administrative privileges (and broader SaaS risk adjacent to Essentials)

Why it matters: DWD is powerful by design. Unused or over-scoped client IDs are a standing privilege problem — similar in spirit to standing privileged roles on Microsoft 365. Teams preparing IRAP-style or insurer evidence increasingly get asked how third-party API access is governed.

Detect early: Inventory authorised DWD client IDs and scopes on a cadence. Remove integrations that no longer need domain-wide access. When connecting Aegis Eight, follow the Google consent wizard scopes deliberately rather than copying a maximal historical set.

Catching drift without another spreadsheet

Point-in-time Workspace assessments go stale for the same reason M365 ones do: people change settings. Continuous monitoring — daily re-scans plus alerts when something material shifts — is how you keep ML claims honest between renewals and QBRs.

Aegis Eight scores Google Workspace via read-only Admin SDK / audit APIs (no agents on endpoints). For partners running many client domains, the MSP fleet view surfaces which tenants regressed, not just a single PDF.

Related reading

Next steps

Questions? Email [email protected].