Google Workspace: Advanced Administration and Security Course

Lesson 1 • Admin Roles and Delegated Administration

Covers built-in admin roles, custom role creation, and privilege scoping. Establishes least-privilege principles applied throughout the course.

Lesson 2 • Google Workspace Service Architecture Overview

Maps the relationship between core services, data centres, and tenant isolation. Provides the mental model needed for every subsequent configuration decision.

Lesson 3 • Admin Console Navigation and Layout

Introduces every major Admin Console section and its primary controls. Builds the spatial familiarity required for efficient day-to-day administration.

Lesson 4 • Organisational Units and Policy Inheritance

Explains the OU tree, policy inheritance rules, and override mechanics. Correct OU design is the prerequisite for all policy-based configurations in later chapters.

Lesson 1 • User Profile Attributes and Directory Schema

Explains standard and custom directory attributes, schema extensions, and their use in access policies. Custom attributes feed into group membership rules covered next.

Lesson 2 • User Account Provisioning Methods

Covers manual creation, CSV bulk import, and API-driven provisioning. Connects provisioning method choice to organisational scale and HR system integration.

Lesson 3 • Offboarding and Account Suspension Workflows

Defines secure offboarding steps: suspension, data transfer, and deletion timelines. Proper offboarding prevents data loss and unauthorised access after departure.

Lesson 4 • Google Groups Types and Configuration

Differentiates email lists, security groups, dynamic groups, and collaborative inboxes. Group type selection directly affects mail routing and access control in later chapters.

Lesson 1 • SAML-Based Single Sign-On Configuration

Walks through SP-initiated and IdP-initiated SAML flows and metadata exchange. SSO configuration builds on the OU and group structures established in Chapter 2.

Lesson 2 • Context-Aware Access Policies

Creates access levels based on device state, IP range, and user attributes. Context-Aware Access enforces zero-trust principles at the application layer.

Lesson 3 • Multi-Factor Authentication Deployment

Covers MFA method types, enforcement modes, and grace period configuration. MFA is the single highest-impact control for account compromise prevention.

Lesson 4 • Password Policies and Strength Enforcement

Sets minimum length, complexity, reuse, and expiration rules per OU. Strong password policy is the baseline before layering MFA and SSO controls.

Lesson 1 • Mobile Device Policies and Compliance Rules

Configures screen lock, encryption, app restrictions, and compliance actions. Compliance rules automate responses to policy violations without manual intervention.

Lesson 2 • Mobile Device Management Fundamentals

Compares basic and advanced MDM modes and enrollment methods for iOS and Android. MDM mode selection determines which policies and wipe capabilities are available.

Lesson 3 • Chrome Browser and ChromeOS Device Management

Enrols Chrome devices, applies browser policies, and manages extensions centrally. Chrome management extends endpoint control to browser-based work environments.

Lesson 4 • Remote Wipe and Data Loss Prevention on Devices

Executes selective and full remote wipe and configures work profile data separation. Data separation limits corporate data exposure on personally owned devices.

Lesson 1 • Compliance Footers, Content Compliance, and DLP

Applies content compliance rules, objectionable content filters, and DLP policies to outbound mail. DLP rules prevent sensitive data from leaving the organisation via email.

Lesson 2 • Email authentication protocols

Configures SPF, DKIM, and DMARC records and interprets alignment reports. Authentication is the prerequisite for all anti-spoofing and deliverability improvements.

Lesson 3 • Email encryption and confidential mode

Configures S/MIME hosted encryption and Gmail confidential mode restrictions. Encryption controls protect message content in transit and at rest.

Lesson 4 • Mail routing rules and gateways

Creates routing rules, split delivery, and dual delivery configurations for hybrid environments. Routing rules enable coexistence with on-premises mail systems.

Lesson 1 • Data classification and labels

Creates Drive labels, applies classification badges, and ties labels to DLP and sharing rules. Labels provide the metadata layer that makes automated policy enforcement precise.

Lesson 2 • Drive sharing controls and external access

Restricts external sharing, link sharing defaults, and trusted domain allowlists. Sharing controls are the first line of defence for Drive-based data exfiltration.

Lesson 3 • Chat and spaces governance

Applies Chat history settings, DLP rules, and external Chat restrictions. Chat governance closes the data leakage gap that email-only policies leave open.

Lesson 4 • Google Vault retention and hold policies

Configures Vault retention rules, litigation holds, and matter-based searches. Vault ensures data is preserved and discoverable for legal and compliance purposes.

Lesson 1 • Security centre dashboard and health page

Interprets security health recommendations and dashboard charts for the domain. The health page surfaces misconfiguration risks that earlier chapters' settings may have introduced.

Lesson 2 • Automated response rules

Creates automated rules that trigger actions such as message deletion or user suspension on alert conditions. Automation reduces mean time to respond to confirmed threats.

Lesson 3 • Reporting and compliance dashboards

Builds custom reports in the Reports section and schedules exports for compliance stakeholders. Regular reporting demonstrates control effectiveness to auditors and leadership.

Lesson 4 • Alert centre configuration and triage

Reviews built-in alert types, configures notification recipients, and establishes triage workflows. Structured triage prevents alert fatigue and ensures critical events are escalated.

Lesson 1 • Google AppSheet and Apps Script for admin tasks

Builds lightweight admin tools using Apps Script triggers and AppSheet interfaces. Low-code automation extends admin capabilities without requiring full engineering resources.

Lesson 2 • Change management and admin change controls

Applies change control processes to Workspace configuration changes using audit logs and rollback strategies. Controlled change management reduces the risk of service disruption.

Lesson 3 • Multi-domain and reseller administration

Manages primary, secondary, and alias domains and configures reseller console delegation. Multi-domain environments require careful OU and policy mapping to avoid conflicts.

Lesson 4 • Admin SDK and Directory API automation

Uses the Admin SDK to automate user, group, and OU management via scripts and pipelines. API automation eliminates manual toil for repetitive administrative tasks at scale.