G Suite Updates Blog

Updating video conferencing policies for delegated and transferred Google Calendar events

July 29, 2020

Quick launch summary We’re making some changes that will affect the Google Meet video conferencing policies applied to a Google Calendar event that is organized by a delegate or when a meeting is transferred. In both cases, Google Meet video conferencing policies will now be based on the person who owns the calendar event, not the delegate or original event owner.
Initially, these changes will only apply to new meetings created after the launch. Over the next several weeks, we’ll apply the changes to existing events as well. Also note that these changes will only apply to primary calendars. For events created on shared calendars or new calendars you create, the policies will be applied based on the user that adds the Google Meet link.
Some specific examples of the potential impact of this change are below.
Impact on meetings set up by delegates

Previously, any Meet video settings would be applied based on the delegate’s settings. Now settings will be applied based on the calendar owner’s settings and so will be consistent with events the owner organizes themselves.
Previously, if the delegate left an organization, the Google Meet video conferencing link in the meeting would stop working. Now, it will continue to work.

Impact on meetings with transferred ownership

Previously, if an event was transferred between users in different organizations or to users with different access policies, any Meet video settings would be applied based on the original owner’s settings. Now, settings will be applied based on the new event owner’s settings.
Previously, if the original owner of a transferred event left an organization, the Meet video conferencing link would stop working. Now, it will continue to work.
Previously, users in the new organization may have had to request access to the meeting if the event was transferred between users at different organizations. Now, users should have the expected automatic access, and users in the original owner’s organization will have to request access unless they’re specifically invited to the meeting.

Use our Help Center to learn more about how Google Meet settings apply to events created on or transferred to other Google Calendars.

Getting started

Admins: There is no admin control for this feature, but admins can manage Meet video settings for their organization. You can also learn more about how Google Meet settings apply to events created on or transferred to other Google Calendars.
End users: This feature will be ON by default. Visit the Help Center to learn more about calendar delegation or transferring events.

Rollout pace For new events created after launch:

Rapid and Scheduled Release domains: This feature is available now for all users.

For existing events:

Rapid and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility.) Policies will be applied over the next several months.

Availability

Available to all G Suite customers and users with personal accounts.

Resources

Dark theme now available for Google Chat on Android and iOS

July 29, 2020

Quick launch summaryWe’re enhancing Google Chat on Android and iOS with dark theme support. Dark theme is a popular feature that’s frequently requested by users. It creates a better viewing experience in low-light conditions by reducing brightness.

Dark theme on Google Chat

Getting startedAdmins: There is no admin control for this feature.
End users: This feature will automatically respect the Android system settings. Visit the Help Center to learn more about turning dark theme on or off for your iOS device.Rollout pace

Rapid and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on July 29, 2020

Availability

Available to all G Suite customers

Resources

Google Help: Turn Dark theme on or off

New beta adds IRM controls for DLP to help protect sensitive content in documents

July 28, 2020

What’s changing You can now automatically restrict the ability to download, print, and copy sensitive documents through data loss prevention (DLP) rules. These new DLP-driven information rights management (IRM) controls, currently available in beta, will make it more difficult for users to make copies of documents that might expose sensitive content.
G Suite DLP rules already enabled admins to limit the sharing of documents directly. However, users could make copies of documents by printing it, copying it to unmanaged locations, or downloading it to physical media. These copies were not subject to the same sharing controls, increasing the risk of that content being exposed.
There are already controls so that document owners and editors can manually prevent viewers and commenters from printing, copying, or downloading their files. However, this placed the responsibility of selecting the correct restriction on a file on end users.

Who’s impacted Admins and end users

Why it’s important The new IRM controls will help ensure that only a single version of sensitive documents exists, and therefore that company DLP policies will help protect it. This could help reduce the potential for accidental or intentional exposure of sensitive content in documents. It also reduces the need for end-users to recognize and manually adjust the IRM settings for files, creating a more scalable and automated process to protect your organization’s content.

Additional details Admin setting for IRM in the DLP rule creation workflow When you’re creating or editing a DLP rule, there will be a new option: “Beta: Disable download, print, and copy for commenters and viewers.” If selected, this will prevent downloading, printing, and copying of the document unless the user has editor or owner permissions. Note that this is only available as part of our new Drive DLP system.

Admins can add IRM controls to DLP rules

Users will see new notifications on affected files Document editors and owners will see a new note when in the settings section of the sharing screen, as pictured below. Users with view or comment access will not be able to download, copy, or print the document—these options will be greyed out for them. Note that this only places limits on “viewer” or “commenter” roles within Drive.

Document owners and editors will see a new note when they try to share the document

Document viewers and commenters will have print, download, and copy options greyed out

Getting started

Rollout pace

This feature is available now for all users.

Availability

Available to G Suite Enterprise, G Suite Enterprise for Education, G Suite for Education, and G Suite Enterprise Essentials customers
Not available to G Suite Basic, G Suite Business, and G Suite for Nonprofits, and G Suite Essentials customers

Resources

Roadmap

This feature was listed as an upcoming G Suite release.

Set the default meeting length for Google Calendar events in your domain

July 28, 2020

What’s changingWe’re adding a new setting in the Admin console where you can define the default Calendar meeting length for users in your domain. Previously, the default of 60 minutes could only be changed from a user's individual Calendar settings. Now, admins can set a new default length for all of their users.
Who’s impactedAdmins and end users
Why you’d use itYou can make your organization more efficient by selecting the default meeting length that makes the most sense for your employees’ time and room usage.
How to get startedAdmins: This new setting’s default value will remain at the standard 60 minutes unless admins take action to change it. Default meeting lengths can be customized at the organizational unit (OU) or domain level. Visit the Help Center to learn more about setting the default duration for events in your organization.

End users: If an admin changes the default meeting value, it will apply to end users who haven’t changed the "Default Meeting Length" setting in their individual Calendar settings and to all new users in a domain. End users will be able to overwrite the admin’s setting from their individual Calendar settings.

Rollout pace

Rapid and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on July 28, 2020

Availability

Available to G Suite Business, G Suite Enterprise, G Suite Enterprise for Education and G Suite for Education customers
Not available to G Suite Essentials, G Suite Enterprise Essentials, G Suite Basic and G Suite for Nonprofits customers

Resources

New device management API available in beta

July 23, 2020

What’s changing We’re launching a beta for a new API to manage company-owned and personal mobile devices and desktop devices. It will work for devices managed via fundamental management, endpoint verification, Drive File Steam, and enhanced desktop security for Windows. Find out more about device management in G Suite.
The new API is part of the Cloud Identity API, and will eventually replace the Admin SDK Directory API used to manage mobile devices.

Who’s impacted Admins and developers

Why you’d use it The new API includes all the capabilities of the Admin SDK Directory API it will replace. In addition, it adds these new features over and above the Admin SDK:

Ability to create and manage company owned devices
Ability to manage Windows devices registered with the Google Credential Provider for Windows
Ability to manage desktop services such as those with the “Endpoint Verification” extension or those with Drive File Stream installed on them

Getting started

Admins and developers: This beta is available by default. See our API documentation to learn more.
End users: No impact for end users.

Rollout pace

Rapid and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on July 23, 2020

Availability

The beta is open to all G Suite customers.

Resources

Developer API documentation: https://cloud.google.com/identity/docs/apis

Say “Hey Google” to do more with your voice on Google Meet hardware kits

July 23, 2020

What’s changingTo make meetings more seamless, all G Suite users can now simply say "Hey Google" to take action on a Google Meet hardware kit. This feature was previously available in beta on ASUS Google Meet hardware kits. It’s now generally available on those same ASUS devices, as well as on Logitech meeting room kits.
With this new feature, you can say “Hey Google” to join and leave video meetings, dial a phone number, and more. For example, try saying, “Hey Google, join my next meeting” to get started, hands-free.

Who’s impactedAdmins and end usersWhy you’d use itVoice control with Google Meet hardware can:

Streamline the in-meeting room experience by enabling touch-free join, exit, and dialing functionality.
Increase accessibility by making it easier to activate spoken feedback.

How to get startedAdmins: This voice control is OFF by default and can be enabled at the domain level. Visit the Help Center to learn more about enabling voice control for Google Meet hardware kits.
End users: End users can disable this feature in the meeting room using the touch screen. Visit the Help Center to learn more about using voice control in video meetings.Rollout pace

Rapid and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on July 23, 2020

Availability

All G Suite editions

Resources

Simplify management of company-owned iOS devices with new Apple Business Manager integration

July 21, 2020

What’s changing We’re launching an integration between Google endpoint management and Apple Business Manager (formerly the Device Enrollment Program, or DEP). This makes it possible to securely distribute and manage company-owned iOS devices from the Google Admin console.
The integration will enable G Suite Enterprise, G Suite Enterprise for Education, G Suite Enterprise Essentials, and Cloud Identity Premium customers to set Google endpoint management as an MDM server on Apple Business Manager.

Who’s impacted Admins

Why you’d use it With the integration between Google endpoint management and Apple Business Manager:

Admins can manage company-owned iOS devices directly from the Admin console, in the same location as they manage other devices that access their organization’s data.
Admins can control a wider range of features including app installation, Apple app usage, authentication methods, and more, as shown in this table of supervised company-owned iOS device settings.
Apple Business Manager and Google endpoint management automatically sync for seamless device management.
Users follow a simple device setup and enrollment through the built-in setup wizard.

Apple Business Manager setup in the Admin console

Getting started

Admins: To use this feature, you need to enable advanced mobile management for iOS devices in applicable OUs, and have an Apple Business Manager account set up. Visit our Help Center to learn more about how to set up company-owned iOS device management.
End users: There is no end user setting for this feature. Once provisioned by an admin, users can follow the device setup wizard steps to enroll the device. Once the setup wizard is complete, the Google Device Policy app will automatically install and the user should sign in to it with their G Suite or Cloud Identity account.

Rollout pace

Rapid and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on July 21, 2020

Availability

Available to G Suite Enterprise, G Suite Enterprise for Education, G Suite Enterprise Essentials, and Cloud Identity Premium customers
Not available to G Suite Basic, G Suite Business, G Suite for Education, G Suite for Nonprofits, and G Suite Essentials customers

Resources

Block apps from accessing G Suite data with app access control

July 21, 2020

What’s changing Last year, we launched app access control to help all G Suite and Cloud Identity customers control access to G Suite data via OAuth 2.0 by third-party and domain-owned apps. Now, we're improving it by allowing admins to block apps from accessing any OAuth 2.0 scopes. This makes it easy for customers to quickly restrict apps that are deemed to be high-risk or compromised.
If an app is blocked, it will not be able to access any data from Google services. It will be blocked whether the app is on iOS, Android, or the web. If users try to authorize the app, they’ll see an authorization error message. Admins can customize this error message if they choose.

Who’s impacted Admins

Why you’d use it
G Suite has a robust developer ecosystem, with thousands of apps available via the G Suite Marketplace and directly to customers, and a rich API framework enabling customers to develop custom apps. Not all apps, however, conform to every enterprise customer’s security policy, so our customers and partners value controls to manage third-party apps accessing G Suite data.
Previously, admins could trust or limit access by specific apps. Now, we’re streamlining this to make it easier to manage potentially thousands of apps, and to help you to more quickly block apps when needed. By adding an option to block an app, you can quickly and efficiently protect data when an app is compromised or high-risk.

You can now block app access to OAuth 2.0 scopes via the Admin console.

Apps can now be trusted, limited, or blocked.

Getting started

Rollout pace

Rapid and Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on July 21, 2020

Availability

Available to G Suite Basic, G Suite Business, G Suite Enterprise, G Suite for Education, G Suite Enterprise for Education, and G Suite for Nonprofits customers
Not available to G Suite Essentials and G Suite Enterprise Essentials customers

Resources

Migration of Drive DLP rules to new system

July 20, 2020

What’s changing In January, we launched a new system that makes it easier to deploy advanced data loss prevention (DLP) policies for Google Drive. This was intended as a replacement to an older, legacy Drive DLP system.
Now, we’re going to migrate any rules you created in the legacy DLP system to this new system. After this migration, you should use the new DLP system to create and manage your organization’s DLP rules for Drive. There are three key things to know:

You can manually migrate your rules to the new system any time before August 10.
Starting on August 10, we’ll automatically move any unmigrated rules to the new system.
These migrations relate to rule management in the Admin console only. There’s no change in how the rules will be enforced for end users.

Use our Help Center to learn more about the migration, and see more details below.

Who’s impacted Admins with privileges to manage DLP rules.

Why it’s important By bringing all your rules into the new DLP system, we’re making it easier to manage your DLP rules and take advantage of the improvements that the new system offers.

Additional details Learn more about the new DLP system The new Drive DLP system offers more advanced policies, additional admin insights, and more flexible deployment than the legacy system. The new Drive DLP functionality can be found at Admin console > Security > Data Protection.
To learn more, see our launch announcement for the new DLP system or visit our Help Center to learn more about the new DLP for Drive. You can also visit our Help Center to learn more about the migration to the new DLP system.

User-controlled migration available now Currently, you can manually migrate your rules to the new UI by manually creating a new rule in the new Drive DLP and then deleting the legacy DLP rule. During that time, you won’t be able to update your rules, but they will still be in effect for end users.
Note that on August 3, customers who have yet to create any legacy Drive DLP rules will not be able to create rules in the legacy system. Existing customers can continue to create and modify rules up until their migration. Rules can be created in the new system at any time.

Before migration takes place, you’ll see a banner about the upcoming changes

Automatic migration will start on August 10 If you haven’t manually migrated your rules by August 10, we’ll start to automatically migrate them to the new system. Migration is expected to complete for most customers by the end of August 2020. A small subset of customers will be migrated in September 2020. Once started for your domain, the migration process can take up to 24 hours, and during that time you won’t be able to modify rules in the legacy system.
Once the migration is completed for your domain, you will see a banner announcing that your DLP rules have moved when you go to the legacy rules location at Admin console > Security > Rules. At that point, you will no longer be able to create DLP rules in the legacy system.

When migration is complete, you’ll see a notification banner in the Admin console
Getting started

Admins: Rule migration is optional until August 10, after which time it will take place automatically. Visit our Help Center to learn now to migrate rules to the new system; go to migrate rules from legacy DLP to new DLP for Drive, or learn more about how to use the new Drive DLP system.
End users: No end user impact.

Rollout pace Automatic rule migration:

Rapid and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on August 10, 2020. Migration is expected to complete for most customers by the end of August 2020. A small subset of customers will be migrated in September 2020.

Availability

Available to G Suite Enterprise, G Suite for Education, and G Suite Enterprise for Education customers.
Not available to G Suite Basic, G Suite Business, and G Suite for Nonprofits, G Suite Essentials, and G Suite Enterprise Essentials customers.

Resources

Meet in Gmail now rolling out on Android

July 20, 2020

Quick launch summaryLast month, we announced that Meet in Gmail would be coming to Android and iOS. The feature began rolling out to iOS last week and starts rolling out to Android today. This means users can join secure video meetings directly from a dedicated Meet tab in the Gmail Android app.

See our previous announcement for more information on this feature.

Getting started

Admins: There is no admin control for this feature.
End users: Meet in Gmail on mobile will be ON by default when users update their Gmail app. Users can hide the Meet tab inside of the Gmail app in their Gmail settings by deselecting “Show the Meet tab for video calling” under “Meet.”Rollout pace

Rapid and Scheduled Release domains as well as personal Google accounts: Gradual rollout (up to 15 days for feature visibility) starting on July 20, 2020

Availability

Resources

Roadmap

This feature was listed as an upcoming G Suite release.

Automatically see shared calendars associated with a Google Group when you join it

July 20, 2020

Quick launch summaryWhen a user joins a Google Group, they’ll now receive an email listing the shared calendars they can access as a result of their group membership—typically within an hour of joining. This will make it much easier for new team members and employees to discover relevant calendars and eliminate the need for existing group members to share those calendars manually.

Example of new shared calendar notification email

Users will also be able to add these shared calendars to their calendar list with just one click.
Note, if a group has more than 100 shared calendars, new members will not receive an email.
Getting startedAdmins: There is no admin control for this feature.
End users: This email will be sent by default whenever you join a new Google Group that has associated shared calendars. Visit the Help Center to learn more about sharing your calendar.
Rollout pace

Availability

Available to all G Suite customers

Resources

G Suite Admin Help: Create and share a group calendar

New Trash feature in Google Contacts

July 16, 2020

Quick launch summary We’re adding Trash to Google Contacts. Now, when you delete a contact, it will go into Trash, where it will stay for 30 days before being permanently deleted. In that time, you can view, restore, or permanently delete the contact. Trash will contain contacts deleted on any device—web, Android, iOS, and more—but you can only view and manage Trash on the web. Trash makes it much easier for users to recover contacts they've accidentally deleted.

Getting started

Admins: There is no admin control for this feature.
End users: This feature will be ON by default. Find it in the left-hand menu when you go to Google Contacts on the web (contacts.google.com). The Trash view is not available yet in the Google Contacts apps for mobile devices. Visit the Help Center to learn more about using Google Contacts.

Rollout pace

Rapid and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on July 16, 2020.

Availability

Available to all G Suite customers and users with personal accounts.

Resources

Google Help: Edit or delete contacts

Push device updates and settings to managed Windows 10 devices more quickly

July 16, 2020

Quick launch summary In April, we launched enhanced security for Windows. It allows admins to push device configuration updates, device settings, and more to Windows 10 devices remotely, without any specific network requirements.
Now, it will be quicker for applied settings to take effect on managed devices faster. Previously, it could take up to six hours for settings to change on a device. With this update, they will take effect in a few minutes in most cases, as long as the device is connected to the internet. This will help ensure devices are updated and in compliance faster and that critical security updates are applied quickly.

Getting started

Rollout pace

Rapid and Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on July 16, 2020

Availability

Available to G Suite Enterprise, G Suite Enterprise for Education, G Suite Enterprise Essentials, and Cloud Identity Premium customers
Not available to G Suite Basic, G Suite Business, G Suite for Education, G Suite for Nonprofits, and G Suite Essentials customers

Resources

Updates to Admin console security settings section, new location for password policy reporting

July 16, 2020

What’s changing We’ve streamlined the security settings section of the Admin console. Specifically you may notice:

Interface and content updates to Admin console > Security
A new location for password policy reporting at Admin console > Reports

See more details below.

Who’s impacted Admins

Why it matters This is the latest in a series of updates we’ve made in the last few months to improve the Admin console. These updates will make your security settings easier to see, and help you find important settings which can help you maintain a strong security posture for your organization.

Additional details Interface and content updates to Admin console > Security

An updated and reorganized interface for the main security settings section at Admin Console > Security.
A new banner to the top of the Admin Console > Security page, which has links to learn more about security and privacy in Google Cloud. Previously this information was in a dedicated section (at Admin console > Security > Security and privacy resources) which has now been removed.
The removal of password policy reporting from this section. It’s now been moved to the Reports section (see more below).

A new location for password policy reporting at Admin console > Reports

Data on user password policy compliance has been moved to the Reports section of the Admin console. Now you can find information such as password strength and length requirements at Admin Console > Reports > Accounts, and Admin Console > Reports > User reports > Security. Previously, this was at Admin console > Security > Password monitoring.

By adding this data to the reports section, you can now use filters, view by OU, view historical values, and download reports features that were not available in the previous location.

In addition, when reporting on password policy compliance, we now simply show whether or not a user’s password length is in compliance with the configured policy. Previously, we stated the specific length of the password.

New password compliance information in the Admin console > Reports section

You can now use filters, view by OU, view historical values, and download reports for password compliance data

The new interface for the Security section of the Admin console

Getting started

Rollout pace

Rapid and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on July 16, 2020