Workspace security · 6-layer architectureWorkspace as a security platform.
Workspace as a security platform.
Six layers, one accountable team.
Workspace was built cloud-native. The security primitives are simpler to operate than the equivalent M365 stack — but only if you actually configure them. Below is the six-layer architecture we deploy on every Workspace engagement, in order. Each layer assumes the one below it is solved.
Identity + access
- Cloud Identity as primary IdP (or federated with Entra / Okta)
- 2-Step Verification enforced for all users
- Advanced Protection Program for high-risk users (executives, IT admins, anyone handling sensitive data)
- Context-Aware Access policies (location / device posture / app)
- Session length policies appropriate to role sensitivity
Identity is the foundation. Every other security layer assumes identity is solved.
Data Loss Prevention (DLP)
- Workspace DLP rules for PII / PHI / PCI patterns
- Block "Anyone with the link" for sensitive sensitivity-labeled content
- Drive label-based DLP with sensitivity classifications
- Outbound mail content scanning
- Custom regex patterns for client-specific data types (account numbers, employee IDs, etc.)
The control that catches the "I just emailed it to my personal account" pattern.
Vault retention + eDiscovery
- Vault retention policies on Drive, Mail, Chat, Meet, and Sites
- Custodian groups defined per organizational structure
- eDiscovery search + export workflows tested annually
- Litigation hold runbook documented + handed to legal
- Retention review cadence (semi-annual) to keep policies current
Vault matters enormously when legal sends a hold. Configure before you need it.
BeyondCorp Enterprise (Zero Trust)
- Context-aware access for all SaaS apps via the Workspace IdP
- Device-trust signals (Endpoint Verification or MDM)
- Geographic + IP-based access controls
- Continuous evaluation rather than at-login-only
- Threat protection for browser-based threats
For mid-market clients with sensitive data, BeyondCorp Enterprise often replaces a separate ZTNA product.
Security Center + Alert Center
- Security Center dashboards monitored 24/7 by our SOC
- Alert Center routing to our incident response queue
- Investigation tool playbooks for the top 5 alert types
- Audit logs streaming to your SIEM (Splunk / Sentinel / Datadog / generic)
- Threat hunting cadence quarterly
Workspace generates a lot of security signal. Most clients never look at it.
Marketplace + add-on governance
- Marketplace allowlist enforced via admin policy (not default-allow)
- App access control restricts data scopes per add-on
- Quarterly review of installed add-ons against approved list
- Vendor risk assessment for any new add-on requested
- BAA / DPA verified for any add-on touching regulated data
The Marketplace is a Shadow IT vector if it is not governed.
The Workspace security stack works when you actually deploy it.
Most Workspace shops have never configured Vault retention, never enforced a Marketplace allowlist, and never run the Security Center reports. The components are built into the platform — unused. Our job is to deploy them in a coherent order with named ownership.