Set the workspace security policy

The Security tab in Admin sets sign-in rules and sharing limits for everyone. Each is a switch with an information icon explaining the effect.

Require two-factor authentication

When on, everyone signing in with a mailbox password must set up an authenticator app first, and is sent to do so at their next sign-in. Two-factor means a password alone is not enough: people also type a 6-digit code from an app on their phone. Turn this on first. It is the single most effective protection.

Allow "Anyone with the link"

Lets people share files, docs, folders and forms with anyone who has the link, with no sign-in. When off, existing public links stop working at once and sharing is limited to people who are added. Public forms need this on. Turn it off if your work is confidential. See Share with a public link.

Allow sharing with people outside the workspace

Lets your team add a named outside person, such as a client or accountant, by email. They confirm their address with a code and need no account. When off, those shares stop working at once.

Only these outside domains limits outside sharing to the companies you list, for example partner.com, client.org. Leave it empty to allow any address. Choose Save after editing.

Allow self-service password reset

People who forget their password can reset it with a code sent to their recovery email (plus their two-factor code when it is on) using Forgot password? on the sign-in page. When off, only an administrator can reset passwords. It only works for people who added a recovery email.

Who has what

• Two-factor by person shows who has set up a code app. People turn it on themselves in Settings, Security. Use Reset if someone loses their phone. They will be asked to set it up again at next sign-in.
• Recovery email by person shows who has one. You never see the address itself. When self-service reset is off, recovery emails are not used.

Good to know

• Policy changes apply at once.
• Turning off public links or outside sharing breaks links people already shared. Tell people first.

Tips

• Combine two-factor with single sign-on if your company has an identity provider.
• Review the Audit log after changing a policy.