Gemini for Google Workspace Security: Admin Controls

Gemini in Google Workspace is switched on by default and can read anything a user can already open, so every oversharing problem in Drive, Gmail and Calendar becomes an AI retrieval problem. The controls that limit it are spread across the Generative AI, Security, Reporting and Vault sections of the Admin console, and several are tied to specific editions. This guide maps the controls Google currently documents for access, admin privileges, connected apps, logging, retention and data loss prevention, and turns them into a hardening baseline. It is for Workspace administrators, identity teams and data protection practitioners. Settings and values were checked against Google Workspace Admin Help and the Generative AI in Google Workspace Privacy Hub in October 2026; confirm them before enforcing, as Gemini features change frequently.

Key takeaways

Gemini inherits user permissions, not a separate model of access. It retrieves only what the user can open, so fixing Drive sharing and labels does more than any Gemini toggle.
Licence status changes the terms. Users on a qualifying edition get the Gemini app as a core service with enterprise-grade protections; users allowed in "regardless of license" fall under consumer terms where chats may be human reviewed.
Turning Gemini off in one app is not a data boundary. A user with Gemini in Gmail can still ask about Drive files; block data with DLP for Gemini, IRM or client-side encryption instead.
Retention lives in two places. The Gemini conversation history setting controls auto-deletion (3, 18 or 36 months), while Vault rules and holds override both admin and user deletion.
Prompt injection travels through shared content. Calendar invites, emails and shared files reach Gemini as context, so confirmation prompts and audit logging matter as much as access settings.

How identity and access work in Gemini for Google Workspace

Gemini uses the user's existing Google Workspace identity. There is no separate Gemini account or tenant: authentication is whatever the Workspace sign-in policy enforces, and authorisation is the user's own access to Workspace data. That makes three layers relevant.

Sign-in: Workspace supports SAML SSO profiles (up to 1,000 per organisation), custom OIDC profiles and a preconfigured Microsoft Entra OIDC profile, assigned to organisational units (OUs) or groups. A group assignment overrides the OU, and up to two SAML certificates can be uploaded to allow rotation. The legacy SSO profile supports one IdP only and Google recommends migrating from it. See the Identity Provider and SSO Security Guide.
Context-Aware Access: Gemini, Gemini Notebook and Gemini Enterprise appear in the app support table under Security > Access and data control > Context-Aware Access. Gemini supports block mode and warn mode (web only). A newly assigned access level starts in monitor mode, which lets you see impact before enforcing.
Data access: Gemini retrieves only content the user can already access. Information Rights Management (IRM) settings that block download, copy or print stop Gemini retrieving those files, client-side encryption (CSE) content is inaccessible to Google systems, and cross-application grounding is disabled by default for files shared from outside the domain.

Setting	Admin console path	Scope	Default
Gemini in Workspace services (Feature access)	Generative AI > Gemini for Workspace > Feature access	Per service: Gmail, Calendar, Drive and editors, Meet, Chat, Workspace Studio; side panel	On
Gemini app service status	Generative AI > Gemini app > Service status	OU or configuration group	On for licensed users over 18
Gemini app user access	Generative AI > Gemini app > User access	"Allow all users to access the Gemini app, regardless of license"; covers gemini.google.com, mobile apps and Gemini in Chrome	Licensed users only
Gemini conversation history	Generative AI > Gemini app > Gemini conversation history	Enable, and auto-delete after 3, 18 or 36 months	On, 18 months
Connected apps	Generative AI > Gemini app > Apps	Workspace apps, Classroom app, Other Google apps	Workspace apps on
Gem sharing	Generative AI > Gemini app > Gem sharing	"Allow users to share Gems"	Not stated by Google

The Feature access panel is only available on Enterprise Standard, Enterprise Plus and some Education editions, and users must also have smart features and personalisation turned on. Most changes take up to 24 hours to propagate; conversation history changes can take up to 72 hours. Configuration groups override OU settings in every Gemini panel, which makes group membership a security-relevant control.

Admin roles and privileged access

Gemini settings are governed by Admin console privileges rather than a separate role model. Assign them through custom admin roles so that AI configuration, audit access and security investigation are separable. See the Google Workspace Security Guide.

Privilege	What it allows for Gemini	Who should hold it
Gemini Settings	Turn the Gemini app and Workspace features on or off, user access regardless of licence, connected apps, Gem sharing, conversation history	A small AI platform admin group; changes reviewed by security
Audit & Investigation	View Gemini for Workspace log events under Reporting > Audit and investigation	Security operations and audit
Security center	Use the security investigation tool for Gemini events	Security operations
Admin privileges for data protection rules	Create DLP for Gemini rules	Data protection team
Vault privileges	Retention rules and holds for Gemini app conversations	Legal and eDiscovery, separate from IT

Restrict super admins: super admins can change all of the above. Keep them few, enforce phishing-resistant MFA and keep them out of daily Gemini use. See the Break-Glass Account Guide.
Watch group-based overrides: because configuration groups override OUs, anyone who can manage group membership can widen Gemini access for a user. Review who manages the groups you target.
Separate legal holds from IT: Vault rules override deletion by users and admins, so the people who can create or delete Vault rules control whether Gemini conversations survive.

Integrations, API tokens and service accounts

The Gemini app can act on connected apps, and Gems and Workspace Studio extend that reach. Each integration is a path for data to leave the user's context or for untrusted content to arrive.

Workspace apps: Calendar, Docs, Classroom, Drive, Gmail, Keep and Tasks can be connected to the Gemini app, on by default. Conversation history must be on for these to work, so turning history off also disconnects them. If one app in a multi-app prompt is off, none of the actions complete.
Other Google apps: Google Maps, YouTube, Hotels and Flights are a separate toggle. These are consumer services; decide whether they belong in a corporate assistant.
Non-Google apps: third-party apps such as Gemini for GitHub are governed through the Google Workspace Marketplace app allowlist, not the Gemini panel. Treat each as an OAuth grant. See the SaaS and OAuth App Governance Guide.
Gems: shared Gems are stored in Drive, so Drive external sharing settings decide whether they leave the organisation. Turning off Gem sharing does not stop Gems already shared in Drive.
Workspace Studio: can be turned on or off, and Gemini can be blocked from Studio steps and starters with API controls. Studio agents act on user data, and log events carry "Agent info" and "By an agent" attributes. See the Agentic AI Security Guide.
Service accounts and API access: service accounts with domain-wide delegation can read the same mail and files Gemini grounds on. Keep them in the same review as Gemini settings. See the Google Cloud IAM and Service Accounts Guide.

The Gemini Calendar prompt injection disclosed by Miggo Security in January 2026 shows the risk: a calendar invite carried hidden instructions, and when the user asked Gemini about their schedule it summarised private meetings into a new event visible to the attacker. Google mitigated it and points to user confirmation before event creation. This is indirect prompt injection (MITRE ATLAS AML.T0051.001) and maps to OWASP LLM01:2025 Prompt Injection and LLM06:2025 Excessive Agency. See the Prompt Injection Guide.

Data protection, retention and training use

Control	What it protects	Limits
DLP for Gemini (Block data access, Audit only)	Stops Gemini using Drive sources that match rules; also scans user-entered text. Covers Gemini app, Gemini in Workspace, Gemini Notebook, Personal Intelligence and Workspace Studio	Drive data only today; Gemini Enterprise and Gemini in Chrome not covered; no warn action documented
Existing Workspace DLP	Generated output inserted into Gmail, Drive and Docs	Gemini Notebook is not integrated with Workspace DLP
IRM (block download, copy, print)	Gemini will not retrieve the file for that user	Applied per file or by policy; also the documented way to keep Drive files out of Gemini Notebook
Client-side encryption	Content inaccessible to Google systems, including Gemini	Requires CSE licensing and key service
Vault retention and holds	Gemini app conversations (prompts and responses), 1 to 36,500 days or indefinitely	New rules take up to 24 hours; messages deleted in that window are not retained

Training and review: Google states that prompts are customer data under the Cloud Data Processing Addendum, and that Gemini in Workspace and Gemini app content for core-service users is not human reviewed or used for model training outside the domain without permission. Feedback is used to improve products but not to train the Workspace models.
Retention periods: Gemini in Workspace prompts and responses are kept from 90 days to indefinitely as admins set; Gemini app conversations up to 36 months. With history off, new chats are still kept up to 72 hours.
Detectors: DLP for Gemini rules use predefined data types, regular expressions, word lists, custom detectors and classification labels, combined with AND, OR and NOT. Labels make rules far more precise. See the Data Classification Guide.
Assurance scope: the Privacy Hub lists SOC 1/2/3, ISO/IEC 27001, 27701, 27017, 27018 and 42001 and FedRAMP High for Gemini in Workspace and the Gemini app, but states Gemini Notebook and Gemini in Chrome are not covered by those certifications or Google's BAA.

Logging and detection

Gemini for Workspace log events are under Reporting > Audit and investigation, with the Audit & Investigation privilege. The event is "Feature Utilization event", with attributes including Action, Actor, Agent info, Application name, By an agent, Event Category, Feature Source, IP ASN and User device ID (the last two must be added as columns). Event Category values are active_conversations, active_generate, active_summarize, active_unspecified, inactive and unknown. The audit tool exports up to 100,000 rows; the security investigation tool, on supported editions, up to 30 million. Google does not state that prompt text is logged, so plan on usage telemetry rather than content.

Gemini use by unexpected users: events from OUs where Gemini should be off point to group overrides or propagation errors.
Agent activity: filter on "By an agent" to separate Workspace Studio or agent actions from human use.
Unusual origin: IP ASN and device ID outside your normal range, correlated with sign-in logs (ATT&CK T1078.004 Cloud Accounts).
DLP for Gemini hits: Block data access and Audit only events show which sensitive Drive sources users try to ground on.
Admin changes: changes to Gemini settings, Gem sharing and Vault rules in the admin and Vault audit logs (ATT&CK T1098 Account Manipulation covers admin-level changes to accounts).

Export via the Admin SDK Reports API into the SIEM so Gemini usage can be joined with Drive and login events. See the Security Data Lake Guide.

Hardening baseline

Clean up first: before wide rollout, review Drive files shared with "anyone with the link" and broad groups, and apply classification labels to sensitive repositories. Gemini will surface whatever is overshared.
Pilot by group: create a configuration group for the pilot, enable Feature access and the Gemini app for it only, and leave the rest of the domain off. Rollback: remove the group or set it to Off; allow up to 24 hours.
Keep licence boundaries: leave "Allow all users to access the Gemini app, regardless of license" off unless you accept consumer terms for unlicensed users.
Set DLP for Gemini in Audit only: start with predefined detectors and labels, review hits for two weeks, then switch high-confidence rules to Block data access.
Protect the crown jewels: apply IRM or CSE to content that Gemini must never read, and use Context-Aware Access in monitor mode, then block mode, for Gemini from unmanaged devices.
Decide retention: set conversation history auto-deletion and a Vault default rule for Gemini app messages that match your records policy and legal hold process.
Trim connected apps: turn off Other Google apps unless needed, review the Marketplace allowlist, and decide whether Gem sharing and Workspace Studio are on.
Wire up logging: grant Audit & Investigation to the SOC, export Gemini log events and set alerts before general availability.

Small vs large organisations: a Business edition customer lacks the Feature access panel and the investigation tool, so its levers are the Gemini app toggle, Drive sharing hygiene and IRM. Large enterprises on Enterprise Plus should combine DLP for Gemini, Context-Aware Access, Vault and SIEM export, and pilot by configuration group. For assistant controls common to every vendor, see the Enterprise AI Copilot Security Guide.

Common misconfigurations

Treating a per-app toggle as a data control: turning Gemini off in Drive does not stop Gemini in Gmail reaching Drive files.
Turning on access "regardless of license": unlicensed users get the Gemini app under consumer terms, outside enterprise-grade protections.
Assuming history off means no retention: chats are still kept up to 72 hours, and Vault rules override user and admin deletion.
Relying on Workspace DLP for Notebook: Gemini Notebook is not integrated with Workspace DLP; IRM is the documented route.
Leaving external calendar and mail content unexamined: invites and messages from outside the domain are attacker-controlled input to Gemini, as the Calendar prompt injection showed.
Ignoring shadow use: blocking Gemini without offering a governed option pushes staff to personal accounts. See the Shadow AI Discovery Guide.

Framework mapping

Control area	NIST SP 800-53 Rev. 5	NIST CSF 2.0	Threat reference
SSO and Context-Aware Access	IA-2, AC-2	PR.AA-05	ATT&CK T1078.004 Cloud Accounts
Gemini Settings and admin privileges	AC-6 Least Privilege	PR.AA-05	ATT&CK T1098 Account Manipulation
Connected apps, Marketplace and Studio	SA-9 External System Services	GV.SC-07	OWASP LLM06:2025 Excessive Agency; ATT&CK T1528 Steal Application Access Token
DLP for Gemini, IRM, CSE	AC-6	PR.DS-01	OWASP LLM02:2025 Sensitive Information Disclosure; ATLAS AML.T0057 LLM Data Leakage
Prompt injection via shared content	SA-9	DE.CM-09	OWASP LLM01:2025 Prompt Injection; ATLAS AML.T0051.001
Log events, Vault retention	AU-2, AU-6, AU-11	DE.CM-09	ATT&CK T1567 Exfiltration Over Web Service

In ISO/IEC 27001:2022 Annex A the main controls are 5.23 (information security for use of cloud services), 5.15 (access control), 8.12 (data leakage prevention) and 8.15 (logging); in CIS Controls v8.1, Control 3 (Data Protection), Control 6 (Access Control Management) and Control 8 (Audit Log Management).

Detection and measurement

Oversharing exposure: count of Drive files shared publicly or domain-wide in OUs where Gemini is on, trending down.
Coverage of sensitive data: percentage of labelled sensitive files covered by a DLP for Gemini rule in Block data access.
Licence hygiene: number of users using the Gemini app as an additional service under consumer terms (target: zero).
Privilege count: admins holding Gemini Settings and super admin, reviewed quarterly.
Log pipeline health: hours since the last Gemini log event reached the SIEM.

Practitioner checklist

Fix Drive oversharing and label sensitive content before enabling Gemini widely.
Pilot Feature access and the Gemini app by configuration group; record settings for rollback.
Keep "Allow all users to access the Gemini app, regardless of license" off.
Assign Gemini Settings, Audit & Investigation and Vault privileges to separate custom roles.
Deploy DLP for Gemini in Audit only, then Block data access; use IRM for Gemini Notebook.
Apply Context-Aware Access to Gemini, starting in monitor mode.
Set conversation history auto-deletion and a Vault default rule for Gemini app messages.
Review connected apps, the Marketplace allowlist, Gem sharing and Workspace Studio.
Export Gemini for Workspace log events to the SIEM and alert on agent and admin activity.

Gemini for Google Workspace Security Guide: Admin Controls and Data Protection