Google
Workspace Administrator

Overview

A Professional Google Workspace Administrator transforms business objectives into tangible Google Workspace configurations, policies, and security practices as they relate to users, content, and integrations. Through their understanding of their organization's infrastructure, Google Workspace Administrators let people work together, communicate, and access data in a secure and efficient manner. Operating with an engineering and solutions mindset, Google Workspace Administrators use tools, programming languages, and APIs to automate workflows, educate end users, and increase operational efficiency while they advocate for Google Workspace and its toolset.

• The Professional Google Workspace Administrator exam assesses your ability to:

• Manage objects
• Configure services
• Troubleshoot
• Access and authenticate data
• Support business initiatives

Syllabus Includes:

Managing objects

Module 1: Managing account lifecycles by using provisioning and deprovisioning processes.

• Transferring ownership data to another account
• Provisioning users based on a process determined by an organization’s policy (for example, where to list accounts)
• Provisioning and deprovisioning accounts, including (Creating, reviewing, updating, deleting accounts (CRUD [create, read, update, and delete]operations).
• • ○ Adding users (for example, individual, bulk, and automated)
  • ○ Offboarding accounts (for example, suspending, deleting, and recovering)
  • ○ Editing user attributes (for example, renaming, passwords, and aliases)
  • ○ Creating administrative roles (for example, default roles, and custom roles)
• Revoking account access outside of a typical organizational policy (for example, security reasons and personnel issues)
• Configuring, monitoring, troubleshooting, and updating lifecycle management by using Google Cloud Directory Sync (GCDS)
• • ○ Auditing and reviewing GCDS (for example, interpreting log data)

Module 2: Configuring Google Drive

• Managing the lifecycle of shared drives based on user requests and organizational policies (for example, OU [organizational unit] placements)
• Configuring shared drive permissions, given specific requirements or scenarios
• Implementing shared drive membership permissions based on organizational policies
• Transferring user data from one user’s drive to another drive
• Applying security best practices for shared drives based on the business need

Module 3: Managing calendar and calendar resources.

• Creating and managing calendar resources
• Managing and delegating calendar access and resources
• Managing the lifecycle of both individual and shared calendars (for example, differentiating between an individual’s calendar and a calendar resource)
• Configuring Google video conference room options (for example, Jamboard, Google Meet)
• Scheduling Google Meet conferences and livestream meetings or events
• Monitoring usage reports and recommending changes
• Troubleshooting calendar issues

Module 4: Configuring and managing Groups for business.

• Configuring memberships and advanced settings, including:
• • ○ Adding users to groups
  • ○ Implementing current Google Workspace APIs
  • ○ Automating tasks by using Apps Script
• Using a Google group to apply membership permissions for a shared drive
• Creating specific types of Google-native groups (for example, dynamic, security, identity-mapped, and POSIX)
• Implementing Google group security access controls to restrict members
• Troubleshooting issues in a Google group (for example, calendar invites not expanding, invites unable to be sent to a group)

Configuring services

Module 1: Implementing and managing Google Workspace configurations based on corporate policies.

• Assigning and configuring permissions to Google Workspace tools by using organizational units (OUs) and Google groups
• Modifying OU policies
• Implementing application and security settings according to OU inheritance and override settings in parent OUs
• Delegating granular Identify and Access Management (IAM) administrator roles and permissions to users in a domain
• Implementing security configuration options for installing or using Google Cloud Marketplace applications or add-ons
• Configuring Drive labels for data organization
• Configuring a Rapid Release or Scheduled Release for feature releases
• Configuring Google Meet to align with corporate policies and requirements
• Creating and configuring security and data region settings
• Implementing security integration protocols and addressing questions and objections from users
• Managing content compliance rules
• Investigating and remediating an issue by using Security Health Analytics check results

Module 2: Configuring Gmail.

• Configuring basic mail routing scenarios for split delivery
• Configuring a mail host
• Configuring end-user access to Gmail by using Google Workspace Sync for Microsoft Outlook (GWSMO) or email client (for example, POP, IMAP, Thunderbird, Outlook)
• Configuring POP and IMAP access to align with corporate policies and requirements
• Configuring administrator access for mail forwarding by using advanced Gmail settings (for example, compliance rules, default routing, APIs)
• Managing and understanding all available spam controls (for example, allowlist, denylist, inbound gateway, and IP allowlist)
• Enabling email delegation for an OU
• Managing Gmail archives

Troubleshooting

Module 1: Troubleshooting mail delivery problems reported by users.

• Determining whether user behavior or a broader issue (for example, rules, or Cloud Data Loss Prevention [DLP]) is causing an error
• Determining whether an issue is an expected behavior (for example, a missing attachment, or an attachment filter issue)
• Auditing and reviewing mail flow structure and end-user actions to determine the root cause of delivery issues
• Analyzing message headers or email audit logs by using Google Workspace tools or security investigation tools/li>
• Recommending and/or implementing an appropriate course of action related to mail delivery issues (for example, implementing mail policy changes)

Module 2: Troubleshooting and collecting logs and reports needed to engage with the support team.

• Documenting steps taken by end user to reproduce an issue
• Collecting appropriate log file types
• Searching for known issues and application status
• Generating HAR files

Module 3: Identifying, classifying, troubleshooting, and mitigating basic email attacks

• Configuring:
• • ○ Blocked senders
  • ○ Email allowlist
  • ○ Objectionable content
  • ○ Phishing settings
  • ○ Spam settings
  • ○ Gmail safety settings
  • ○ Administrator quarantine
  • ○ Attachment compliance
  • ○ Secure transport compliance
• Implementing Sender Policy Framework (SPF); Domain-based Message Authentication, Reporting, and Conformance (DMARC); Mail Transfer Agent Strict Transport Security (MTA-STS); and DomainKeys Identified Mail (DKIM) to secure email transmission
• Investigating whether custom configurations are responsible for any issues or vulnerability (for example, email allowlist and IP addresses)
• Investigating the scope of email attacks by using available Google Workspace email tools
• Analyzing message contents for common attack patterns (for example, name, domain, and brand spoofing)
• Mitigating successful attacks and preventing future attacks by using Google Workspace email tools (for example, identifying the issue and responding)

Module 4: Troubleshooting Google Workspace access and performance issues.

• Identifying why a user is having an issue when they access a single Google application (for example, Drive)
• Identifying the root cause of a performance issue when accessing a Google Workspace application (for example, a known issue, an outage, a network, or a device)
• Analyzing, evaluating, and modifying settings to ensure delivery of critical emails (for example, specific IP ranges, X-headers)
• Troubleshooting authentication issues that users reported
• Troubleshooting issues that users reported when they set up Google Workspace on a mobile device
• Troubleshooting Google Meet video call issues from the administrator console
• Troubleshooting Google Meet device issues by using the administrator console
• Troubleshooting network configuration issues to ensure high-quality meetings by using Google Meet
• Troubleshooting Jamboards
• Troubleshooting access to Google Workspace services (for example, Gmail and Drive)
• Troubleshooting data visibility issues by enabling/disabling licenses or services
• Investigating access issues in applications for OUs
• Interpreting and responding to alerts in the Alert Center API Data access and authentication

Data access and authentication

Module 1: Configuring policies for all devices (for example, mobile device, desktop, Chrome OS, Google Meet Hardware, Jamboard, Google Voice, and browser)

• Configuring:
• • ○ Chrome user and browser policy settings
  • ○ ChromeOS device policy settings (for example, Enterprise)
  • ○ Windows 10 login and device policies (for example, Google Credential Provider for Windows (GCPW)
  • ○ Managed Chrome browsers (for example, Chrome Browser Cloud Management)
  • ○ Basic device management
  • ○ Basic and advanced device management for Android and iOS
  • ○ Company-owned device management for Android and iOS
  • ○ Context-aware access policies
  • ○ Personal device settings for Android and iOS (for example, password, advanced, device approvals, application management, and insights)
• Enabling Endpoint Verification security by using BeyondCorp

Module 2: Configuring and implementing Gmail DLP and sharing access control lists (ACLs) based on governance policies.

• Identifying areas of improvement for secure collaboration based on data exfiltration reports
• Scanning emails by using Gmail DLP
• Implementing Gmail DLP policies to prevent the over-sharing of sensitive data
• Configuring and implementing Gmail DLP options for data classification
• Configuring and implementing data classification settings on Drive
• Implementing context-aware access policies based on data governance policies
• Configuring settings to limit external sharing on Drive based on organizational policies
• Configuring settings to limit email delivery based on organizational policies
• Configuring and implementing client-side encryption services for Drive

Module 3: Managing third-party applications. Considerations include:

• Implementing automatic releases of a browser extension to OUs within the domain
• Implementing security configuration options for installing or using Google Cloud Marketplace applications or add-ons
• Reviewing and authorizing user requests for a new Google Workspace Marketplace application, Google Play, or a Chrome extension
• Pushing an application to a user’s phone by using Google’s mobile device management (MDM)
• Configuring Google as a Security Assertion Markup Language (SAML) provider for a third-party application
• Deploying password-vaulted apps
• Deploying and restricting Google Workspace Marketplace and Google Play Store applications
• Granting API access to applications
• Integrating third-party user provisions
• Integrating third-party marketplace applications to specific OUs in Google Workspace
• Managing access to additional Google services (for example, AdSense and YouTube) for a specific set of users
• Revoking third-party author access
• Removing connected applications and sites

Module 4: Configuring user authentication.

• Configuring:
• • ○ 2-step Verification for the administrator and high-risk accounts (for example, requiring a physical key or not allowing SMS)
  • ○ 2-step Verification for low-risk and standard accounts (for example, Google Authenticator)
  • ○ Google-side connection to third-party single sign-on (SSO) providers
  • ○ Google multi-IdP options for SSO
  • ○ Basic SAML SSO configuration for third-party application authentication when Google is the SSO provider
  • ○ Third-party SSO for Google Workspace
  • ○ Access control based on the use of the security functionality within API Controls
  • ○ Google session control based on a company’s legal policies
• Implementing basic user security controls (for example, password length enforcement)
• Implementing security aspects of identity management, perimeter security, and data protection

Supporting business initiatives

Module 1: Using Vault to support legal initiatives.

• Configuring retention rules based legal security policies (for example, setting retention rules, placing legal holds, exporting data for additional processing and review, auditing reports, and searching a domain's data by user account, OU, date, or keyword)
• Assisting with or creating:
• • ○ Legal matters to hold data
  • ○ Export matter content (data) for analysis
  • ○ Delegation protocols for Vault access
  • ○ Google Workspace content by using Vault (searching)
  • ○ Legal holds for Google Workspace content by using Vault
  • ○ Vault audit reports (running)

Module 2: Creating and interpreting reports for the business.

• Generating and interpreting user adoption reports (for example, Work Insights)
• Investigating issues by using the Alert Center
• Investigating and monitoring a service outage for a specific Google Workspace application
• Investigating issues by using data objects and metrics available within activity reports
• Configuring group alerts triggered by a specific event
• Creating and reviewing audit logs
• Using BigQuery to combine multiple Google Workspace logs and usage reports to provide actionable insights

Module 3: Supporting data import and export.

• Assisting with off-boarding employees and transferring data (for example, Drive, Calendar, and Google Data Studio)
• Migrating Gmail data between Google Workspace accounts
• Exporting data from Google Workspace offline or to other platforms