Why Google Workspace Is In SOC 2 Scope

For most SaaS companies, Google Workspace is the identity backbone — it controls which employees can log into your applications, your cloud consoles, and your development tools. When SOC 2 auditors evaluate CC6.1 (logical access) and CC6.3 (access revocation on role change), Google Workspace is directly in scope.

Auditors check three things: Is 2FA enforced for all users? Do admin accounts follow least privilege? Are inactive or offboarded users promptly removed? All three are verifiable in Google Admin — but only if you've configured and are monitoring them.

Enforce 2FA Organization-Wide

Google Workspace allows administrators to require 2-Step Verification for all users. Navigate to:

Admin Console → Security → Authentication → 2-Step Verification

Configure:

• Allow users to turn on 2-Step Verification: On
• Enforcement: Turn on enforcement (choose either "On" or a grace period for new hires — 7 days max is typical for SOC 2)
• Allowed methods: Prefer authenticator apps or hardware keys; allow phone prompts; optionally exclude SMS (SMS is weaker and some auditors flag it)
• Exceptions: Require explicit justification for any account with 2SV disabled

For SOC 2 evidence, export the "2-Step Verification enrollment" report from Admin Console → Reports → User Reports → Security monthly and retain it.

SecureSpect check: gsuite.users.mfa_enforcement — monitors 2SV enrollment across all active users and flags any account without 2SV enrolled, not just whether enforcement is on.

Audit and Limit Super Admin Accounts

Super Admin accounts in Google Workspace have unlimited access to all user data, settings, and audit logs. SOC 2 requires that privileged access follows least privilege (CC6.1) and that only the minimum necessary users have elevated access.

What auditors expect:

• Fewer than 4 super admin accounts for most companies under 200 employees
• Super admins are not used for day-to-day work (separate standard accounts for email, calendar, etc.)
• Super admin accounts have hardware key 2FA, not just authenticator apps
• Super admin access is reviewed quarterly

How to audit: Admin Console → Account → Admin Roles → Super Admin → Assigned Admins

Review this list quarterly. Document the review with the reviewer's name, date, and the list of accounts reviewed — this is your CC6.1 evidence.

SecureSpect check: gsuite.admins.count — flags when the super admin count exceeds the configured threshold (default: 4).

Monitor Inactive Users and Suspended Accounts

Dormant accounts are a SOC 2 access control risk — particularly accounts belonging to departed employees that weren't fully deprovisioned. Google Workspace's Admin Console surfaces last-login dates, but you need to actively monitor and act on them.

Detection: Admin Console → Reports → User Reports → Accounts — sort by last login date

Policy to document:

• Accounts inactive for more than 90 days are reviewed for deactivation
• Offboarded employees' accounts are suspended within 24 hours and fully deleted within 30 days
• Suspended accounts are reviewed monthly and purged after the retention period

SecureSpect check: gsuite.users.inactive_accounts — surfaces accounts with no activity in the last 90 days, and gsuite.users.offboarded_with_active_accounts — surfaces accounts for users who were removed from your HR system but still have active Google accounts.

Delegated Admin Roles — Scope-Limiting Admin Access

Instead of making everyone a Super Admin who needs administrative access, use Google Workspace's delegated admin roles to scope privileges:

• User Management Admin — can create/suspend/delete users without accessing all settings
• Groups Admin — can manage groups without touching user accounts
• Help Desk Admin — can reset passwords without broader access
• Services Admin — can manage app access without user management

Document which roles are assigned to which accounts and review this list quarterly alongside your access review.

Connecting Google Workspace to SecureSpect

SecureSpect connects to Google Workspace via a Service Account with domain-wide delegation — a read-only connection using Google's Admin Directory and Reports APIs. No user credentials are stored. Initial setup requires a Google Workspace super admin to create the service account, grant it delegation, and paste the credentials into SecureSpect.

Once connected, SecureSpect monitors 2FA enrollment, super admin count, and inactive users continuously — and maps every finding to the SOC 2 control it satisfies. Evidence is collected automatically for your audit.