NICOLETTE STEPAKOFF: Hey.
Niccolette here.
I'm a Google Workspace specialist
focused on public sector, and today, we
will be discussing mobile device management.
There are two levels of mobile device management
within Google Workspace--
basic, which is on by default, and advanced.
Each level of management gives you
a different set of features.
With basic management, you can keep corporate data
safe by requiring that mobile devices have a screen
lock or even a password.
Again, you don't need to do anything to turn basic on.
It's on by default.
Now, let's say you want more control
over mobile devices that accessed your organization's
data.
You can use advanced management to do things
like enforce stronger device passwords
or restrict access to devices, settings, and features.
Let's take a peek at how to set up
mobile device management within Google Workspace Admin Console.
I'll navigate to the Admin Console.
And from the Admin Console, move your gaze to the left
and select the caret dropdown to the left of Devices.
In the Devices dropdown, we'll go ahead and select the caret
to the left of Mobile Endpoints.
And lastly, you will select the caret to the left of Settings.
In our Settings, we're going to find Universal Settings.
Once we're in our Universal Settings,
we'll move your gaze to the right.
And I'm going to go ahead and click on our General section.
Here we can see that this demo environment has advanced
MDM enabled, and that's because we want
to enforce strong passwords.
Now, similar to Gmail security, I
can choose the password strength,
the screen lock time out, and more.
Let's hop back into Universal Settings
by using the breadcrumbs in the upper left corner.
Over on the right, we have a few different options.
We have Data Access and Security.
Let's review Data Access first.
Data Access includes things like endpoint verification,
where you can monitor which device accesses
your organization's data.
You have iOS and Android sync.
And then you have Google sync, which
allows users to sync their mail to their mobile devices.
Just below data access, you have security.
So the two most common features in security
are device approvals over on the right, which requires an admin
approval before a user can access their work
data on their personal mobile device.
And the second most commonly used feature is encryption.
That's in the lower left.
This requires data encryption on devices
so that data can only be read when a device is unlocked.
So encryption does add protection
if a device is stolen or lost.
Unlocking the device does decrypt the data.
Now, if a user has a wild weekend on vacation
and loses their mobile device that has,
let's say, an open connection to the user's Workspace account
or maintains cookies that permit a connection without first
entering a username or password, that Workspace account
is potentially exposed to anyone who has possession
of that computer or device.
We do have the ability to block, wipe, or delete
a device if it's compromised by setting up a device rule.
So let's go ahead and navigate our gaze back to the left here.
We're going to scroll down to Rules
under Mobile and Endpoints.
I'll go ahead and click on rules.
So here we have a few rules already defined,
like the second one that says block
an account on multiple failed screen unlocks.
We'll go ahead and focus on that one right now.
I'll go ahead and click into it.
And we'll find our scope.
So here we have our name and a brief description.
Below that, we can define who we would like this to impact.
So you can say everyone within your organization or maybe
a specific OU.
So right now, this rule is only going
to be set for the altostrat dash A-Local Gov dash DOIT OU.
In the lower right, we'll click that blue Continue button,
and then we can set our conditions.
So here, what we're saying is that if there's a failed screen
unlock attempt seven times or more.
So if someone has that compromised device
from that wild weekend, if they try to unlock this seven times
or more on this Android device, it will automatically
lock the device.
It will also-- in the lower right,
we'll hit Continue-- send an alert to the Security Center
so all super admins will get an email stating someone is trying
to access this device and has tried
to log in seven or more times.
One more time in the lower right-- we'll choose Continue.
And you can actually review your rule
before you actually enable it.
We'll click Finish in the lower right,
and then we'll make this rule active,
meaning it's going to turn on for the OU we have selected.
In the lower right, we'll choose complete.
And just like that, we've set up a device rule.
That was Mobile Device Management.
In the video so far, we've covered compliance,
clientside encryption, context-aware access,
and mobile device management.
Are you wondering how you can get
started testing out all these fun features and tools?
Good news-- you can easily set up a Google Workspace trial.
Stay tuned for our next video on how to sign up
for a Google Workspace trial.
And be sure to check out the description below
for helpful links and subscribe to the Google Workspace YouTube
channel for more updates.
Thanks for joining us.