Security policy and the fraud shield

Workspace security policy

In Admin, the Security tab sets rules for everyone in the workspace. Each is a switch, with an information icon explaining the effect.

• Require two-factor authentication: everyone signing in with a mailbox password must set up an authenticator app first. People are sent to set it up at their next sign-in. A Two-factor by person list shows who has it, and lets you reset a person's two-factor if they lose their phone.
• Allow "Anyone with the link": lets people share files, docs, folders and forms with anyone who has the link. When it is off, every public link already shared stops working at once and sharing is limited to people who are added. Public forms need this on.
• Allow sharing with people outside the workspace: lets someone add a person outside the company by email. They confirm their address with a code and need no account. When off, those shares stop working at once.
• Only these outside domains (optional): limits outside sharing to the companies you list, for example partner.com, client.org. Leave it empty to allow any address.
• Recovery email by person: shows who has set a personal address for password resets. Self-service reset only works for people who added one.

Tip: Turn on two-factor first. It is the single most effective protection, and it takes people one minute.

Other tabs complete the picture: Single sign-on connects the workspace sign-in to other tools, Audit log records who changed what and when ("for checking when a setting changed or looking into a problem"), Compliance and Data export help with legal requests, and API keys control programmatic access.

The fraud shield

Business email fraud usually looks like an urgent request or a supplier saying their bank details changed. The Fraud shield watches for these and shows a warning banner in Mail. It never deletes, moves or blocks mail on its own.

In Admin, the Fraud shield tab lets you:

• Set Sensitivity, meaning how suspicious a message must look before it gets a warning.
• Enable Notify administrators about dangerous messages.
• Add Extra names to protect, such as the names of your executives, one per line, then choose Save names.
• Review the allow and block lists built from people's decisions. Removing an entry (bin icon) puts that sender back to normal checks.

It learns who you normally deal with, so it becomes more accurate over the first couple of weeks.

Working the Shield page

Open Shield. Two tabs:

Flagged messages lists suspicious mail, filtered by Open, Fraud, Fine and All. Open one to read Why it was flagged with a Danger or Warning badge. Then choose:

• This is fine to put the sender on the allowlist.
• Report as fraud to block them, with an option to move the message to Junk.

For administrators these apply to the whole workspace. For others they apply to the person's own mailbox.

Payment checks lists payment detail changes. When a message says a supplier's bank details changed, the shield creates a check, showing only the last four characters of the new details. It must be confirmed out of band: call the number you already have on file, such as from an old invoice or the supplier's website, never one from the email. Two different people must confirm before anyone pays the new details. Each records how they checked and a note. Choose I confirmed the new details, or They didn't change them, reject. Filters are Waiting, Verified, Rejected and All.

Policy for your team

1. Never pay changed details on the strength of an email alone.
2. Record the call in the note.
3. Report suspicious mail with Report as fraud, so the shield learns.
4. Review the Audit log monthly.