---
title: Google Workspace Admin Best Practices in GAT Suite
description: "There are many different ways [Google Workspace](https://workspace.google.com/) admin can set up Google domain to efficiently protect against possible threats and prevent data loss. The [GAT Suite](https://gatlabs.com/) of tools specializes in Security Management and Data Loss Prevention. GAT requires very little…"
url: "https://gatlabs.com/knowledge/tech-tips/best-practices-gat/"
updated: "2023-08-08"
category: Getting Started
tags:
  - GAT Flow
  - GAT Shield
  - GAT Unlock
  - GAT+
---

# Google Workspace Admin Best Practices in GAT Suite

There are many different ways [Google Workspace](https://workspace.google.com/) admin can set up Google domain to efficiently protect against possible threats and prevent data loss.

The [GAT Suite](https://gatlabs.com/) of tools specializes in Security Management and Data Loss Prevention.

GAT requires very little setup on installation, but here are a list of some popular actions and best practices you can take as the administrator, to better optimize your domain for DLP.

## Best Practices List

- Generate a monthly report on the extensions your employees are installing
   [Chrome extensions audit](https://gatlabs.com/knowledge/tech-tips/chromebook-chrome-extensions-auditing/)
- Restrict users from downloading potentially malicious file types
   [Report and remove file downloads ](https://gatlabs.com/knowledge/tech-tips/how-to-report-and-remove-files-downloaded-by-users/)
- Setting up alerts for when racial/homophobic language is used (and take a screenshot)
   [Configuring settings for Alert Rules](https://gatlabs.com/knowledge/tech-tips/configuration-settings-options-available-in-gat-shield-for-alert-rules/)
- Categorize sites with tags so you can see at-a-glance if employees are working
   [Auditing sites with browsing tags](https://gatlabs.com/knowledge/tech-tips/auditing-in-gat-shield-with-site-urls-and-browsing-tags/)
- Set up an alert for when Two Factor Authentication is disabled
   [Alert when 2FA is disabled for any reason](https://gatlabs.com/knowledge/tech-tips/alert-when-2fa-is-disabled-for-any-user-in-your-google-domain/)
- Set up document tracking for docs containing sensitive data
   [Track visitors and editors of specific documents](https://gatlabs.com/knowledge/tech-tips/how-to-track-visitors-and-editors-of-specific-documents/)
- Set up policies for applications allowed on the domain
   [Policies for Google Workspace apps](https://gatlabs.com/knowledge/tech-tips/audit-and-policy-for-google-workspace-apps/)
- Create copies of externally owned files
   [List all externally owned files](https://gatlabs.com/knowledge/tech-tips/listing-of-all-files-shared-into-the-domain/)
- Remove public access to files (automatically after being shared)
   [Remove public and public-with-link permissions from Google Drive Files](https://gatlabs.com/knowledge/tech-tips/remove-public-and-public-with-link-permissions-from-google-drive-files/)
- Remove files shares to personal accounts
   [Find all files shared to Gmail accounts and remove them](https://gatlabs.com/knowledge/tech-tips/find-all-files-shared-to-gmail-accounts-and-remove-them/)
- Monitoring User Logins
   [Monitoring Google Cloud login behaviour](https://gatlabs.com/knowledge/tech-tips/monitoring-google-cloud-login-behaviour/)
- Find out who's missing their meetings
   [Report when the Google Meet organiser is not present](https://gatlabs.com/knowledge/tech-tips/google-meet-with-no-organizers-present/)
- Set up alerts for Email Delegation
   [Email delegation alert rule](https://gatlabs.com/knowledge/tech-tips/alert-for-email-delegation-from-google-users/)
- Set up alerts for new email filters
   [Alert for new Gmail filter added](https://gatlabs.com/knowledge/tech-tips/set-up-a-google-alert-when-a-new-filter-is-added-in-gmail/)
- Automate actions that will be taken when a user violates an alert
   [Set up event workflows based on GAT+ alerts via GAT Flow](https://gatlabs.com/knowledge/tech-tips/set-up-event-workflows-based-on-gat-alerts-via-gat-flow/)
- Force users to change their passwords every 3 months (set as a recurring workflow to run automatically)
   [Change users passwords at the next login in bulk](https://gatlabs.com/knowledge/tech-tips/gat-flow-change-user-passwords-in-bulk/)
- Allow users access to shared drives and sensitive folders automatically, only when 2FA has been enabled (and remove access if 2FA is disabled)
   [Run workflows based on 2FA change](https://gatlabs.com/knowledge/tech-tips/trigger-a-workflow-when-users-disable-or-enable-2fa-with-gat-flow/)
- Remove email filters regularly (automatically)
   [Remove users email filters in bulk](https://gatlabs.com/knowledge/tech-tips/remove-user-email-filters-for-several-users-in-bulk-via-gat-flow/)
- Configure a set of actions to do when offboarding users (transfer files, remove app tokens, set Out of Office reply)
   [Actions available when offboarding users](https://gatlabs.com/knowledge/tech-tips/actions-available-when-offboarding-users/)
- Deploy the GAT Shield extension to everyone in your organization
   [Deploy GAT Shield](https://gatlabs.com/knowledge/tech-tips/how-to-deploy-gat-shield/)