You can lock down company data across phones and laptops in under an hour with the controls already in your admin console.
I have seen admins delay endpoint security because the console looks bigger than it is. In practice, a few settings, one Chrome extension, and a short monthly review cover the highest-risk gaps.
Start with a small baseline, then tighten rules where the risk is higher. The same process works for a team of 50 devices or 5,000.
Key Takeaways
A strong rollout starts with a small baseline, posture-based access, and a repeatable monthly review.
- Basic management is already on. Every domain starts with Basic mobile management active. Advanced management adds passcode enforcement, work profiles, device approval, and remote wipe for stronger control.
- Context-Aware Access blocks weak devices. You can require encryption, screen lock, minimum OS version, and even region before a user opens Drive or Gmail. Stolen credentials alone will not reach data.
- Endpoint Verification gives you desktop signals. A lightweight Chrome extension reports encryption status, OS version, and screen lock data for Windows, macOS, and Linux devices.
- Native enrollment removes manual work. Android zero-touch enrollment and Apple Business Manager let devices arrive already managed, which cuts setup mistakes and support tickets.
- Monthly audits stop policy drift. Export inventory, find non-compliant endpoints, and block them with access rules before a small gap turns into an incident.
What Workspace Covers for Endpoints
One admin console can enforce core controls across phones, tablets, laptops, and browsers.
Built-in endpoint controls work across Android, iOS, iPadOS, Windows, macOS, and ChromeOS. You manage them through two tiers, Basic and Advanced, inside the same Admin console.
Basic management uses agentless controls, which means no separate management app is required for core actions like account wipe and screen lock reporting. Advanced management adds stronger passcode rules, Android work profiles, iOS app control, device approval, full remote wipe, and minimum OS enforcement. Endpoint Verification is a Chrome extension that reports desktop posture. Context-Aware Access, or CAA, is the policy engine that decides who can reach apps based on identity, device health, IP address, and location.
Basic vs. Advanced at a Glance
- Password rules: Basic supports simple screen lock. Advanced lets you require standard or strong passcodes.
- Remote wipe: Basic supports account-only wipe. Advanced adds full device wipe for company-owned hardware.
- App management: Basic offers no app control. Advanced lets you manage approved Google Play and iOS apps.
- Work profiles: Basic does not support them. Advanced creates a separate work container on employee-owned Android devices.
- Device approval: Basic auto-approves. Advanced can require admin approval before first access.
- OS requirements: Advanced enforces minimum OS versions such as Android 6.0 or later and iOS 12 or later. Basic does not.
Feature availability depends on your edition. If you enable Advanced on an unsupported license, only Basic settings apply. Windows management also requires Advanced endpoint management and is not available on legacy G Suite Basic or G Suite Business.
Set Your Baseline in 30 Minutes
A short baseline gives you most of the protection you need on day one.
Turn on the minimum safe set across the whole org, then add tighter controls by organizational unit. IBM’s 2024 Cost of a Data Breach report puts the global average breach at USD 4.88 million, so a half hour of setup is cheap insurance.
Confirm Your Edition and Choose a Management Level
Open Admin console and go to Devices > Mobile and endpoints > Settings > Universal settings. Confirm that your edition supports Advanced mobile management. If it does, assign Advanced to the organizational units that handle higher-risk users or company-owned devices.
Confirm Basic Mobile Management
Basic management should already be active. Check it under Devices > Mobile and endpoints > Settings. Require a screen lock, enable remote sign-out, and turn on device reports so you can see enrollment status from the start.
Enable Advanced Mobile Management
For the units that need more control, switch the management type to Advanced under Universal settings. Users will need the Device Policy app on Android or a management profile on iOS. Tell them before you flip the setting, or your help desk will spend the morning answering surprise prompts.
Require Device Hygiene
Set minimum OS levels for each platform. Require encryption and screen lock, and block compromised or jailbroken devices. Those three rules stop a large share of opportunistic access tied to lost or weakly protected devices.
Set Approvals and Blocks
Require admin approval for first-time device access. Review pending devices under Devices > Mobile and endpoints > Approvals. Use account wipe for personal phones and full device wipe for company-owned hardware, then delete stale records every month.
Keep a short internal runbook with these menu paths so another admin can repeat the setup without guesswork. That simple document also helps when you need to train a backup owner.
If you want a neutral visual reference after you finish these setup steps, it helps to compare your console paths with a short screenshotted walkthrough before you repeat the baseline for another organizational unit, document the process in a runbook, or hand the task to a backup admin. For further reading, see Google Workspace device management for a simple view of the core setup and policy screens.
Harden Access at the Device Layer
Passwords alone are not enough, so app access should depend on device posture.
CAA and Endpoint Verification are the two controls that change this from a simple sign-in policy to real device-aware access.
Turn On Context-Aware Access
Go to Security > Access and data control > Context-Aware Access. Create an access level that requires encryption and an active screen lock. Apply it to Drive, Gmail, Chat, and the Admin console. You can also limit access by region or to approved devices only.
Deploy Endpoint Verification
Force-install the Endpoint Verification Chrome extension under Devices > Chrome > Apps and extensions. Add the native helper for Windows and macOS. Once it is live, you can see encryption, screen lock, and OS version data in inventory and use those signals in your CAA rules.
Chrome Browser Cloud Management
Enroll browsers with the token under Devices > Chrome > Managed browsers. On Windows, use a registry key to force enrollment. Start with three high-value policies, Safe Browsing, an extension allowlist, and the built-in password manager.
Make Platform-Specific Moves
Native enrollment methods save time and cut down on ghost devices.
Use each platform’s built-in enrollment path instead of one-off manual setup. The initial work is small, and the long-term cleanup is much easier.
Android
Link your reseller account for zero-touch enrollment, which assigns management at first activation, under Devices > Mobile and endpoints > Settings > Third-party integrations. Apply a default configuration so eligible devices enroll automatically. Use fully managed mode for company-owned hardware and work profiles for employee-owned phones. Block unknown sources and auto-install approved Google Play apps.
iOS and iPadOS
Advanced iOS management needs an Apple Push Certificate. Generate the request in Admin console, sign it in the Apple Push Certificates Portal, and upload it. Renew it every year. Then connect Apple Business Manager and use the Volume Purchase Program to distribute apps during setup for company-owned devices.
ChromeOS and Chrome Browser
ChromeOS devices and Chrome browser policies are managed from the same Admin console at no extra cost. Enroll ChromeOS devices during initial setup, then apply user and device policies. For Windows, macOS, and Linux browsers, use Chrome Browser Cloud Management.
Windows
Deploy Google Credential Provider for Windows, or GCPW, so users can sign in with their Google accounts. Enable Windows management where your edition supports it, enforce BitLocker encryption, and restrict local admin rights. This feature is part of Advanced endpoint management and is not available on legacy editions.
Run Day 2 Operations to Prevent Drift
A simple monthly routine keeps strong settings from quietly slipping after rollout.
Good policies fail when nobody checks stale records, risky changes, and user workarounds. A short review cycle fixes that without adding much admin time.
Create Rules and Alerts
Create Data Protection rules under Security > Access and data control > Rules. Watch for external sharing spikes, sensitive content matches in Drive and Chat, and bulk downloads through Chrome. Add Activity rules for risky admin changes, such as lowering a management level.
Show Users the My Devices Portal
Point users to mydevices.google.com. They can see enrolled devices, sign out remotely, or wipe a lost phone without waiting on the help desk. That speeds up response and cuts ticket volume.
Audit Monthly
Export inventory from Devices > Mobile and endpoints. Filter for unencrypted devices, out-of-date operating systems, and stale records. Then tighten CAA rules or send targeted reminders. A 15-minute review each month catches drift before it becomes a serious problem.
Quick Comparison: Baseline vs. Hardened
The move from baseline to hardened is small in the console but big in risk reduction.
- Screen lock only becomes screen lock plus encryption plus CAA enforcement.
- No app control becomes managed Google Play and Volume Purchase Program app distribution.
- Auto-approved devices become admin-approved devices with posture checks.
- Browser unmanaged becomes cloud-managed browser enrollment with an extension allowlist.
- No desktop signals becomes Endpoint Verification data feeding real-time access decisions.
- Reactive wipe requests become faster user self-service through the My Devices portal.
FAQs
These four questions cover the issues that usually slow a rollout.
Which Editions Support These Controls?
Advanced mobile management and Windows management require supported editions such as Business Plus, Enterprise, or Education. If you enable Advanced on an unsupported license, only Basic settings apply. Check Account > Subscriptions before you change management levels.
What Is the Safest Way to Remove Corporate Data From a Personal Phone?
Use an account-only wipe. It removes the managed account and its work data without touching personal photos, apps, or files. Reserve full device wipe for company-owned hardware that needs a factory reset.
Do You Need a Third-Party MDM If You Already Use Workspace?
For most small and midsize teams, the built-in endpoint tools cover Android, iOS, ChromeOS, Windows, and macOS well enough. A third-party mobile device management tool can still help if you need deeper OS patching, custom scripts, or support for platforms not covered here.
How Can You Show Leadership That the Policies Work?
Export monthly compliance reports that show encryption rates, OS currency, and blocked access attempts. Pair those numbers with CAA deny logs and rule alerts. Trends are easier for leaders to understand than a long list of settings.
Set a clean baseline, tie app access to device health, and review inventory every month. That small routine prevents most weak-device problems before they turn into incident response.