Google Workspace for Small Businesses: 9 Admin Settings to Get Right

Google Workspace gives a business Gmail, Drive, Calendar, Meet, Docs, Sheets and administrative controls in one environment. But paying for business email and creating employee accounts is only the beginning.

A poorly configured Workspace environment can still have unmanaged access, confusing file ownership, excessive sharing permissions and weak account protection. These problems become more expensive as a team grows.

If you are setting up Google Workspace for a small business, or reviewing an existing environment, use this guide as a practical starting checklist.

The exact controls available depend on your Google Workspace edition, administrator privileges and organisational requirements. Treat this as a configuration framework, not a substitute for reviewing your own security and compliance needs.

1. Secure administrator accounts first

Administrator accounts have more power than ordinary user accounts. If one is compromised, an attacker may be able to change settings, access information or affect other users.

Start by reviewing who has administrator privileges. Give people only the roles they need to perform their responsibilities. Avoid using a highly privileged administrator account for routine email and everyday browsing where a separate standard account is practical.

Also make sure administrator accounts have strong, unique passwords and appropriate account recovery methods.

Google's guidance for administrators is available in the Google Workspace Admin Help Centre.

2. Enforce two-step verification

A password alone is not enough protection for a business account.

Two-step verification (2SV) adds another step when a user signs in. Depending on the methods supported by your organisation and account, users may verify with a security key, passkey, Google prompt or another supported method.

A practical rollout looks like this:

1. Review the organisation's current 2SV settings.
2. Decide which verification methods your organisation will support.
3. Communicate the deadline and setup instructions to users.
4. Give users time to enrol and resolve access issues.
5. Enforce the policy according to your organisation's rollout plan.
6. Document recovery and account-access procedures.

Do not enforce a new sign-in policy without planning for users who lose a device or cannot complete setup. A security control needs a recovery process.

Read Google's 2-Step Verification guidance.

3. Organise Google Drive around the organisation, not individual employees

One of the most important decisions is where business files should live.

Files in an employee's My Drive are generally owned by that individual. Shared drives are designed for team and organisational content: files in a shared drive belong to the team rather than one individual. This means files contributed to a shared drive remain there when a member leaves.

A simple structure might look like this:

Do not create shared drives just to create more folders. Give each drive a clear purpose, assign membership deliberately and review access regularly.

Google explains the difference in What are shared drives?.

4. Create a consistent naming and folder standard

A Drive structure should make sense to someone who did not create it.

Set simple rules for:

• Shared drive names.
• Department and project folders.
• File naming conventions.
• Draft, review and approved document status.
• Archive locations.
• Who is responsible for maintaining each area.

For example, a file name such as 2026-11-14_ClientName_ServiceAgreement_v1 is more informative than Final document new latest.

Avoid building deeply nested folder structures that make files difficult to find. The right structure is the one your team can understand and maintain.

Google also recommends using clear purposes and naming conventions for shared drives. See its shared drive best practices.

5. Review external sharing and access permissions

A file being easy to share does not mean it should be shared with everyone.

Review how users share files outside the organisation. Decide when external sharing is appropriate, who can create public or broadly accessible links, and how sensitive information should be handled.

Use the principle of least privilege: give each person the minimum access required for their work.

For example:

• Viewers should not receive editing access when they only need to read a document.
• Temporary contractors should not retain access after their engagement ends.
• Sensitive HR or finance files should not sit in a broadly accessible folder.
• Shared drive membership should reflect current team responsibilities.

Google's guide explains how file access works in shared drives.

6. Authenticate your business email domain

If your business sends email from its own domain, email authentication should be part of your setup.

Three important standards are:

SPF: identifies the mail servers authorised to send email for your domain.

DKIM: adds a digital signature that helps receiving systems verify that a message was authorised by the sending domain and has not been altered in transit.

DMARC: tells receiving systems how to handle messages that fail authentication checks and provides reporting options.

These records must be configured carefully. If you use other services to send email, such as a CRM, newsletter platform or website application, make sure your SPF and DKIM configuration accounts for the legitimate senders. Do not publish multiple conflicting SPF records for the same domain.

Google provides official instructions in its email sender guidelines.

7. Set up groups for teams and role-based access

Google Groups can make access administration easier.

Instead of granting access to the same files and resources to employees one by one, you can use groups that reflect team responsibilities, where your Workspace edition and sharing configuration support that approach.

Examples include:

• all-staff@yourdomain.com
• finance@yourdomain.com
• operations@yourdomain.com
• marketing@yourdomain.com

When someone joins or leaves a team, updating group membership can be easier than reviewing dozens of separate file permissions.

Groups are not a replacement for permission reviews. Check what each group can access and make sure membership is accurate.

8. Build an employee onboarding and offboarding process

Account creation and account suspension should follow a repeatable process.

For onboarding, document:

• Who approves the account request.
• Which organisational unit or settings apply.
• Which groups the employee should join.
• Which shared drives and applications they need.
• Whether additional security setup is required.

For offboarding, document:

• Who confirms the employee's departure.
• When access should be suspended.
• Which business files need to be transferred or retained.
• Which groups, third-party applications and shared resources need review.
• Who is responsible for preserving business continuity.

Do not rely on an employee's manager to remember every file and application they have used. Maintain an access and application register where appropriate.

9. Schedule recurring Workspace reviews

Google Workspace administration is not a one-time setup task.

Create a recurring review schedule for:

• Administrator roles.
• Suspended and inactive accounts.
• Group membership.
• Shared drive membership and permissions.
• External sharing.
• Third-party application access.
• Email authentication and security alerts.
• Onboarding and offboarding records.

The frequency should reflect your organisation's size, risk and regulatory requirements. A small team may start with a monthly access review and a more detailed quarterly audit.

A practical Google Workspace setup checklist

• Administrator privileges are limited to authorised people.
• Two-step verification is configured and users have a recovery process.
• Business files are stored in appropriate shared drives.
• Shared drive membership and access levels are documented.
• Folder and file naming standards are established.
• External sharing rules are understood.
• SPF, DKIM and DMARC are reviewed for the domain's actual email senders.
• Groups reflect current teams and responsibilities.
• Employee onboarding and offboarding procedures exist.
• Workspace access and configuration reviews are scheduled.

Final thoughts

Google Workspace becomes more valuable when it is administered as a business environment rather than treated as a collection of separate apps.

Good administration means knowing who has access, where company information lives, how accounts are protected and what happens when someone joins or leaves.

Start with the basics: secure administrator accounts, organise shared drives, review permissions and document repeatable processes. Then improve the environment as your organisation grows.

If your team needs practical training in Gmail, Drive, Docs, Sheets, Forms, Calendar and the wider Google Workspace environment, explore the FTHS Google Workspace Mastery Course.