Client-side encryption can now be selected as a data loss prevention condition

What’s changing 

You can now use client-side encryption as a condition for a data loss prevention (DLP) rule. As with other DLP rules, you’ll be able to configure: 
If users are warned before sharing externally. If users are blocked from sharing externally. The ability to download, print, or copy the document are disabled for commenters and viewers. Whether these events should be sent to the Alert Center for further investigation. 
Client-side encryption goes beyond the latest cryptographic standards used by Workspace by giving organizations authoritative control and privacy as the sole owner of private encryption keys and the identity provider of the encryption keys. Combining client-side encryption with DLP rules help our admins build an even stronger framework around sensitive data and information.

Getting started

Admins: Visit the Help Center to learn more about creating data loss prevention rules for Google Drive, as well as client-side encryption.End users: Use our Help Center to learn more about working with encrypted files in Drive, Docs, Sheets & Slides.

Rollout pace

Rapid and Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on April 24, 2024

Availability

Available for Google Workspace:
Enterprise PlusEducation Standard and Plus

Resources

Seamlessly transfer between devices during a Google Meet call

What’s changing

In today’s world, getting our work done can happen from many locations, across many devices. Beginning today, you can smoothly transfer between devices while on a Google Meet call without hanging up and rejoining. For example, if you were taking a Meet call on your mobile phone or tablet, you could smoothly switch to your laptop when you arrived at your desk. You’ll notice the new “Switch here” option when joining a meeting on your laptop, which will switch the call from your mobile devices while maintaining an ongoing conversation and without worrying about missing important information. 

Select the “Switch here” option to seamlessly switch between devices without interruption

Getting started

Admins: There is no admin impact or action required.End users: Visit the Help Center to learn more about transferring a meeting between devices.

Rollout pace

Rapid Release domains: Gradual rollout (up to 15 days for feature visibility) starting on April 24, 2024Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on May 9, 2024

Availability

Available to all Google Workspace customers and users with personal Google accounts 

Resources

Import data from Slack to Google Chat using CloudFuze

What’s changing

We recently announced the ability to import data from other messaging platforms using the Google Chat API. To build upon this, we’re excited to announce a new migration solution from CloudFuze that enables you to import data from Slack into Google Chat. 
With this integration, you can move messages and memberships from Slack channels into Chat spaces. CloudFuze also imports data while maintaining historical timestamps to ensure users can start using spaces right where they left off.

Who’s impacted 

Admins and developers 

Why you’d use it 

Developed in collaboration with Google Workspace, CloudFuze imports your knowledge repository from Slack into Google Chat. 

Additional details 

To import user data from other messaging platforms into Google Chat, please review the original blog post on how to create a Chat app to migrate data. 
Visit the CloudFuze resource page to learn more about user integrity preservation, optimum Cloud Authentication, migration security and more. 

Getting started 

Rollout pace 

Availability 

Available to all Google Workspace customers. Note that a separate CloudFuze licensing is required to enable data migrations. 

Resources 

Get notified about application load failures for your Google Meet Hardware devices

What’s changing 

As part of an ongoing series of improvements for managing Google Meet hardware devices, we recently announced that we would begin capturing application load failures across Meet hardware devices. Beginning today, you can now opt-in to receive email or text message notifications when these failures occur. Subscribing to alerts can help you stay on-top of what’s happening across your hardware fleet and quickly take action to resolve these issues.

Getting started

Admins: Visit the Help Center to learn more about getting connectivity and peripherals alerts and understanding device usage in your organization.End users: There is no end user impact or action required.

Rollout pace

Rapid and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on April 25, 2024. We anticipate rollout to take around six weeks to complete.

Availability

Workspace Data Protection rules are now available for Gmail in Beta

What’s changing 

Launching first to beta, we’re introducing data loss prevention rules for Gmail. Data protection rules help admins and security experts build a stronger framework around sensitive data to prevent personal or proprietary information from ending up in the wrong hands. This functionality is already available in Google Chat and Google Drive, and in Gmail you’ll be able to create, implement, and investigate rules in the same manner. 
Admins can create data protection rules to flag sensitive information from using your organization. These rules are applied to outgoing messages sent internally or externally and admins can choose whether all content (including attached files and images), the body of the email, email headers, or subject lines should be scanned. You can configure your rules to look for sensitive text strings, custom detectors, or select predefined detectors. If a message violates a rule, admins can choose to:
Block message — the sender will receive a notification about message delivery failure and more information about the policy they violated.Quarantine message — the message will require review and approval by an admin before delivery. If the message is rejected by an admin, the user may receive a notification about it.Audit only — the message is delivered, but it is captured in rule log events for further analysis. This is particularly advantageous because it allows admins to assess the impact of rules before introducing them to your end users.
Data loss prevention for Gmail are available for select Google Workspace customers (see the “Availability” section below) — no additional sign-up is required to use the feature. 
Create data protection policies for Gmail alongside Drive and Chat
Build flexible conditions with selection of predefined and custom detectors of sensitive information
Set up a rule with Audit Only action applied to messages sent outside of organization. The severity level for event logging is set up to ‘Medium’ and alerting via Alert Center is turned on 
Detailed information about the event in the Alert Center

Overview of DLP incidents in the Security Dashboard with further option to investigate audit logs in detail

Who’s impacted

Admins and end users

Why it’s important

In addition to detecting sensitive content, DLP in Gmail offers additional benefits such as:
Simplified deployment and data protection policies management with rules for Gmail, Drive and Google Chat unified into the same area and workflow.Advanced detection policies with flexible conditions, wide selection of predefined detectors for global and regional information types, custom detectors (Regular Expressions and word lists), targeting on specific parts of a message (header, subject, body). Granular configuration of policies scope, defining sender audiences (at domain, OU, and group levels) and recipient audiences (internal, external, both).Actions with various levels of restriction such as block delivery of message (Block), quarantine message for review (Quarantine), and log event for future audit (Audit only).Tools for incident management and investigation such as the Alert Center, Security Dashboard and Security Investigation Tool.

Additional details

How does DLP in Gmail compare to Content Compliance rules?
Content compliance in Gmail does offer similar functionality in that you can create rules to prevent messages that contain specific content from being sent. However, unlike DLP in Gmail, admins have no way to preview the impact of these rules before deploying them broadly.
Further, content compliance offers a variety of features that are better suited for filtering content. For example, you can:
Set up a metadata match on a range of IP addresses, and quarantine messages from IP addresses outside of the range.Route messages with content that matches specific text strings or patterns to a specific department, suited the best to process information.

Getting started

Admins: Data loss prevention rules can be configured at the domain, OU, or group level. DLP rules can be enabled in Gmail in the Admin console under Security > Access and data control > Data protection. Visit the Help Center to learn more about controlling sensitive data shared in Gmail.Note that you can modify existing DLP rules for Drive and Chat to also apply to Gmail. DLP events can be reviewed in the Security Investigation Tool or Security > Alert Center, if alerts are configured in rules.

We recommend selecting “Audit only” when you’re setting up a rule. When selected, messages that match the conditions of a rule will be delivered with the detection being logged. This allows you to rest new rules and monitor their performance, or to passively monitor the  environment without interrupting email flow for your users.

Note on asynchronous and synchronous scanning: With DLP for Gmail, data protection rules are scanned asynchronously, which means that the message is blocked or quarantined after it leaves the sender’s mailbox and before being dispatched to the recipient. We’re working on the ability to scan data protection rules synchronously when a user hits “Send” in order to notify users about sensitive content before the message leaves their mailbox. 

Please share your feedback on this feature with us — this will help us continue to improve the experience as we move through beta and toward general availability. You can share your feedback by selecting the “Send feedback” button located in the bottom left corner of your screen of any data protection related page in the Admin console.

End users: When configured by your admins, you’ll be notified if your message contains information that violates a DLP rule

Rollout pace

Rapid Release and Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on April 26, 2024

Availability

Available to Google Workspace:
Enterprise Standard, Enterprise PlusEducation Fundamentals, Standard, Plus, and the Teaching & Learning UpgradeFrontline StandardCloud Identity Premium customers