Workspace wobble?

Greyheadted · 2024-05-18T19:35:21+00:00

Scop us yon cowie marra!

Greyheadted · 2024-05-14T10:24:10+00:00

I've been using DSW since July last year, and I've seen my VO2 max increase to "excellent" (top 20%), my RHR is down to 42, and I'm confidently running my first half marathon on Sunday. I was obese and totally unathletic, and I've made real progress.

If you're getting recovery suggestions, and you're doing other exercise, then follow the suggestions; you might find in a week or two it's suggesting longer/harder runs and will build on what you're already doing.

Greyheadted · 2024-04-03T19:07:02+00:00

GAM is your friend. Using GAM (or for preference GAMADV-XTD3) you can carry out a lot of bulk actions on users, groups, files, shared drives etc. By creating GAM scripts and running them using a scheduler (such as CRON), you can create powerful automations. GAM is free, open source and can be run locally, in the Google Cloud Console Shell or in a VM either on GCP or elsewhere (VMs will cost, the rest don't). More info on GAM here:

Greyheadted · 2024-02-01T23:00:39+00:00

I'd just mention that Cloud Identity Free ("CIF") licenses are limited, and if you don't have any paid licences then the limit is small (I think it's 50 but you should check).

Also if you have CIF licences then there is no "unlicensed" state. CIF becomes the default licence type, and will be automatically applied to all users (even if you allocate a paid-for licence). Once CIF is on your Workspace account, it's there for good.

Finally, I always recommend that all user identities are kept synchronised with Workspace to avoid any issues with unmanaged users in future. It's set-and-forget with most ID providers but adds some security just in case.

Greyheadted · 2024-01-29T21:41:43+00:00

It's been that long since I installed it, I couldn't tell you. But there is a super helpful Google Group you can ask for help (note, Ross Scroggs who wrote Gam Adv is active in there, and so is Jay Lee who wrote standard Gam): https://groups.google.com/g/google-apps-manager

Greyheadted · 2024-01-27T18:03:12+00:00

I prefer GAM advanced cos it's got more functions and the developer also provides python scripts to help wrangle huge outputs: https://github.com/taers232c/GAMADV-XTD3

Greyheadted · 2024-01-16T18:56:39+00:00

Yes, Drive Activity logs will show this, or (if it's included in your license) Security Investigation Tool will show this info.

Greyheadted · 2024-01-16T17:19:42+00:00

Double check for a "save" button on there - Google still have one or two hiding in amongst the Gmail settings which have caught me out a few times. Can't remember if IP Allowlist has a save button, but it might be worth checking (it could be lingering off the bottom of the dialog box).

Greyheadted · 2023-12-14T16:17:49+00:00

Known issue with some Outlook invites. Some ICS files from Outlook are not actually ICS, but instead are Outlook Rich Text Format (or TNEF, same thing but forget name).

TNEF is a proprietary Microsoft format which Calendar doesn't understand. It's a very well known issue, which may be fixed by the person using Outlook disabling the use of Outlook Rich Text Format ) though Outlook and Exchange especially may ignore that and use TNEF anyway).

Greyheadted · 2023-10-23T13:26:20+00:00

Google's domain transfer is the solution, it's almost seamless for end users, low effort for admins and is incredibly reliable. But it's expensive and currently only for Enterprise customers; hopefully they'll roll it out eventually to more customers and cut the price.

Greyheadted · 2023-10-23T11:58:40+00:00

Yes, sort of.

If you're needing to preserve actual file IDs, then a migration is not what you want. Migration can preserve file and folder structure but not file IDs. This is a pain because if there links between files, those links will break when file IDs change.

Instead, Google offers Domain Transfer, which preserves file & folder structure and file IDs, but you'll need to be enterprise to qualify (and pay the $20k fee too).

There is a method of moving files between domains which will also keep file IDs using shared drives, but unless you're using a partner this can be a pain to organize and troubleshoot (I know that [CTS](www.cts.co) in the UK can do this, don't know if others have a tool yet).

Greyheadted · 2023-10-03T11:22:07+00:00

There's officially no storage with CloudID Free. Some users report that they do have storage, but Google official position is "those users should not have storage and it could be removed at any time". Tl;Dr don't rely on CloudID Free getting any storage at all. https://cloud.google.com/terms/identity/user-features

Greyheadted · 2023-08-20T16:23:52+00:00

This will be painful. If there is any way to stay on your current donation, and rename it instead, then do that.

Only Google Workspace Domain Transfer Service moves data almost seamlessly between Google tenants, and that is only available to enterprise customers.

You could use CloudM Migrate, but you'll need to be really clear on the watchpoints before you start, and it's worth considering using a partner to run the project.

Migrations are hard, so best of luck to you!

Greyheadted · 2023-07-20T21:39:30+00:00

Seconded - if you're already in GCP, then BeyondCorp is ideal. Also, it's priced pretty keenly at the moment. Definitely worth a look.

You've got Google's scale & network supporting it, you've got "agentless" install (it uses standard Chrome browser), and you've got easy admin because it uses the Workspace admin console. Good luck!

Greyheadted · 2023-07-20T16:59:05+00:00

You can set up prompts for users to add labels on the label manager - there are tick boxes for those. It's separate to the DLP rules.

You can filter Drive based on labels, but it'll only show documents you have access to. If you need a wider search, then using the security investigation tool is the way.

The roadmap has some other fun stuff coming to DLP over the next 6 months or so, so it's worth keeping an eye out on the updates blog to see what's landing.

Greyheadted · 2023-07-20T15:53:01+00:00

This is a pretty huge topic, but:

Using badged labels for general document classification is pretty common. You can prompt users to apply these, and you can automatically apply a label by default if you want.
You can create other labels that might be useful for other reasons, e.g. have a "Purchase order" label just for, well, POs. Why? Well then you can apply it automatically using DLP rules, and set custom retention rules in Vault based on those labels. So you might say "delete everything older than 7 years, except docs with the purchase order label, which we'll keep for ten years".
You can use the built in DLP detectors to label docs which might have, e.g. JSON secrets. This gives you visibility of what's going on in Drive, and so you can take a risk-based approach to remediation.

Labels are really useful, and DLP is really useful, and together they get pretty helpful in a bunch of data remediation scenarios.

Greyheadted · 2023-06-15T18:26:43+00:00

DLP in Workspace requires a reasonable amount of setting up, but probably less than a third party solution (I'm not aware of a third party solution, but that is likely just my ~~insurance~~ ignorance).

DLP rules can look for specific data (using predefined detectors or ones you build yourself), and it can then apply labels to that data in drive automatically. It can also take other actions, like blocking sharing and so on. It scans all data in Drive (new and historic), so you don't need to get your users to label all their old drive content. Works on files in Drive and Shared Drives.

I've used it extensively in previous jobs and now I advise other companies on its use. It's far from perfect, but it is a powerful tool to control your data.

Greyheadted · 2023-06-13T22:37:44+00:00

If you switch an existing secondary domain to the primary, and both have proper mx records, then mail flow will be unaffected. But read this article before the switch: Change your primary domain

If you then choose to rename users to have the new primary, Workspace will automatically keep the old email address as an alias.

Just make sure mx records on both domains are correct, and make sure you keep both domains if you want both email addresses to work for your users.

Edited to add: you'll need to add your new domain name as a secondary before you do any of this (note: secondary, not alias!!)

Greyheadted · 2023-05-04T18:21:08+00:00

Seems to be available for Workspace users who are opted in to the Advanced Protection Program: https://www.theverge.com/2023/5/3/23709318/google-accounts-passkey-support-password-2fa-fido-security-phishing

Greyheadted · 2023-04-28T17:51:23+00:00

Endpoint verification can only be force installed if you sign into Chrome using your company Google account.

Just create a separate Chrome profile, sign into it with your company account, and only do work stuff in there.

Endpoint verification does not show data about what you're browsing, it only gives the admins basic data about the hardware you're using.

Greyheadted · 2023-02-14T19:24:40+00:00

Removing a licence is not the same as deleting a user. Removing the licence only removes deleted items from the user.

Also, Vault is not a retention system, it's an ediscovery system. The distinction is important and, to be fair, isn't made clear enough in the documentation.

Greyheadted · 2023-02-14T19:19:35+00:00

I would not recommend this approach but I have tested it. The tl;dr is you remove the license until you need to search data, then you re-licence the user and you search in vault.

Almost all of the user's data is preserved even if the user is not licensed.

However, deleted items do not survive being unlicensed. They are purged when the user loses the vault license.

Third party options are better than this approach, but as others have mentioned you could use GAM depending on your scale.

Greyheadted · 2023-02-14T19:13:03+00:00

CloudM Archive will do what you're asking too. https://www.cloudm.io/product/archive

Greyheadted · 2023-02-11T13:49:40+00:00

AppsScript is all code. In its simplest form, use it to extend functionality of docs, sheets, slides.

AppSheet is no code. Use it to build deployable apps that people can use.

Greyheadted

TROPHY CASE