Skip to main content
Suitebriar(888) 545-3685Talk to a Google expert
A man working on a laptop in an airport lounge
Cybersecurity & Compliance

Google zero trust architecture
for Google Workspace.Modern access control for a perimeter-less world.

Suitebriar helps organizations implement Zero Trust security controls across Google Cloud and Workspace, ensuring users, devices, and applications are protected no matter where work happens.

Plan your Zero Trust rolloutWhat each control needs

Trusted by teams at

  • Reddit
  • Cloudflare
  • Okta
  • Zapier
  • Dialpad
  • Prezi
  • Century 21 Canada
  • Berkshire Hathaway HomeServices Homesale Realty

What is Google's zero trust architecture for Workspace?

In Google Workspace, zero trust means every request to Gmail, Drive or another Workspace app is checked against who the person is, the device they're using and where they are, not whether they're on the office network, and checked again while they work.

Three Google pieces do most of it: 2-Step Verification for identity, Google endpoint management and Endpoint Verification for the device, and Context-Aware Access to turn both into rules for each app. Chrome Enterprise Premium, the product Google used to document as BeyondCorp Enterprise, carries the same checks and DLP into the Chrome browser for apps outside Workspace. The catch is editions: Context-Aware Access needs Enterprise, Frontline or Education Standard and above, and Business editions don't include it.

A man in an office checking his phone beside his open laptop

Zero Trust controls we deploy

Identity-centric access policies

2-Step Verification moved from allowed to enforced, admin accounts first, with security keys or passkeys for the people phishing targets most.

Endpoint management + context-aware access

Devices at the right management level and Endpoint Verification on desktops, then rules such as encrypted company devices only for Drive.

App access restrictions

Third-party apps set to trusted, limited or blocked for Gmail and Drive data, starting from the list of apps people already use.

DLP and data-sharing controls

Limits on sharing Drive files outside the organization, and DLP rules in Gmail, Drive and Chat. DLP in Chrome needs the Chrome Enterprise Premium add-on.

Auditing + continuous monitoring

Access to Workspace apps rechecked throughout each session, and alert center alerts with someone assigned to act on them.

What each control needs

Editions decide most Zero Trust plans on Workspace. People on an edition without Context-Aware Access aren't covered by a policy, even when their group has one.

ControlWhat it checksWhat it needs
2-Step Verification enforcementA second step beyond the password at sign-inEveryone enrolled before the enforcement date, and off text-message codes before methods are restricted
Fundamental device managementMobile passcodes; wiping the work account from a phoneIncluded in Business Starter and above
Advanced device managementStrong passcodes, full device wipe, Android work profilesBusiness Plus, Enterprise, Frontline, Education Standard and above, or Enterprise Essentials
Context-Aware AccessIdentity, device, location and IP for each app; Workspace apps rechecked during the session, SAML apps at sign-inEnterprise Standard or Plus, Frontline, Education Standard or Plus, Enterprise Essentials Plus or Cloud Identity Premium, and Endpoint Verification on desktops
Third-party app controlsWhich apps can reach Workspace dataThe list of apps already in use, reviewed before anything is restricted
DLP rulesSensitive content in Gmail, Drive and ChatEnterprise, Frontline or Education editions; not Business
Chrome DLP and other appsUploads, downloads, pasting and printing in Chrome; access to non-Google appsThe Chrome Enterprise Premium add-on

How a Zero Trust rollout runs

  1. Start with an auditA Google Workspace security assessment shows where sign-in, sharing, apps and devices stand today, for each organizational unit.
  2. Lock down identityEnforce 2-Step Verification, admins first, once enrollment is checked and people are off text-message codes.
  3. Bring devices under managementEndpoint Verification on desktops and the right management level on phones, so device conditions can be checked at all.
  4. Enforce by app and groupContext-Aware Access rules for each app, one group at a time, with app access and DLP controls alongside.
A woman on a phone call at her desk with a laptop open

Zero Trust FAQ

What IT leads ask before tightening access to Google Workspace.

Not sure what your edition allows?

Tell us your Workspace edition and how people get to your apps today, and we'll talk through which controls fit.

(888) 545-3685Plan your Zero Trust rollout
Which Workspace edition do we need?

For the full set, Enterprise Standard or Plus, or the Frontline and Education equivalents. Business editions don't include Context-Aware Access or DLP rules, and only Business Plus has advanced device management, so Zero Trust on Business leans on 2-Step Verification enforcement and Drive sharing settings.

Do we need Chrome Enterprise Premium?

Only for what Workspace doesn't cover: DLP inside the Chrome browser (uploads, downloads, pasting, printing) and Context-Aware Access to apps outside Google. For Gmail, Drive and the other Workspace apps, Context-Aware Access on a supported edition does the job. It's a paid add-on, the product Google previously called BeyondCorp Enterprise.

Will it lock people out?

It can, in three predictable ways: people still using text-message codes when 2-Step Verification methods are restricted, desktop browsers other than Chrome when a device rule applies (they can't verify the device, so they're blocked), and phones that aren't enrolled in management. Check each one before a rule is enforced.

What about personal phones?

Fundamental management can remove just the work account from a phone. Advanced management, on Business Plus and above, adds Android work profiles, which keep work apps separate from personal ones, and full device wipe for company phones.

Can we turn off our VPN?

Often, yes. Suitebriar helps organizations move from VPN access to Google's zero trust model. Chrome Enterprise Premium, the product Google used to document as BeyondCorp Enterprise, gives Context-Aware Access to SaaS, cloud and on-premises apps from Chrome, so access depends on the person and the device rather than the network.

Related services

Cybersecurity & ComplianceSecurity assessments, Zero Trust, email security and complianceSecurity Assessments & Risk ManagementStart with a Google Workspace security auditCompliance AutomationGap assessments, control design and automated evidence workflowsGoogle Workspace with GeminiRoll out, govern and train on Gemini

Plan your Zero Trust rollout

Tell us your Workspace edition, the devices people use and the apps they reach outside Google.

  • Google Cloud Premier Partner, working only on Google Cloud and Workspace for more than a decade
  • U.S.-based support team

Free AI starter kit

From your data to your first AI agents, in four steps

Google's AI starter kit for lean teams: your four-step guide from data to agents.

  • Four steps, from a first no-code win to a multi-step agent workflow
  • Use cases with sample prompts, plus the ABCD prompting technique
  • Best practices for data quality, governance and human oversight