Google Workspace Administrator (GCX)

Virtualization, Google

This course delivers a structured overview of administering and securing Google Workspace, focusing on configuring security policies, using the Admin Console and applying Audit logs with the Investigation Tool for forensic analysis of Gmail, Drive and login activity.

It covers practical prevention and response: enforcing MFA/2SV, DLP rules for Gmail and Drive, configuring SPF/DKIM/DMARC and Context-Aware Access, integrating with SIEMs and automating tasks via Admin SDK, APIs and GAM for incident reporting and audits.

THIS TRAINING COURSE WILL HELP YOU:

  • Configure Workspace security policies (MFA, DLP, sharing, alerts)
  • Investigate incidents: build timelines and identify attacker activity
  • Use Admin Console, audit logs and APIs for forensic analysis
  • Design prevention processes: user training, sharing limits, automation

WHO SHOULD ATTEND?

  • Google Workspace administrators and security specialists
  • IT and helpdesk teams at companies migrating to SaaS
  • Auditors, consultants and SOC analysts handling cloud incidents

COURSE LOCATION AND AVAILABLE DATES



Private training

This course is not scheduled as a public course.
It is delivered exclusively as customised training. The content, duration, date, and delivery format are tailored to the customer's requirements and can also be provided in English.

Request customised training

Course content:

Hide details
  • Introduction to Google Workspace and SaaS security
    1. Shared Responsibility Model — responsibilities of Google vs. the customer
    2. Roles and org structure (Org Units, Groups, Access Groups)
    3. Licenses and editions (Business / Enterprise) and security implications
    4. Typical threats (phishing, public links, auto-forwarding, OAuth)
  • Admin Console and Audit logs
    1. Key Admin Console areas (Alert Center, Security Rules)
    2. Working with Email Log Search, Drive Audit, Login Activity
    3. Investigation Tool (Enterprise) — building queries and exporting results
    4. Exporting logs (CSV, Reports API, BigQuery) and offline analysis
  • Forensic analysis — practical case study
    1. Data exfiltration and email forwarding incidents
    2. Downloading and analysing logs (Drive, Email, Login)
    3. Creating an attack timeline — attacker steps and stolen files
    4. Remediation steps (password resets, MFA, removing forwards)
    5. Structuring reports and communicating with management
  • Security policies and data loss prevention
    1. MFA / 2SV and SSO integration (Azure AD, Okta)
    2. DLP rules for Gmail and Drive
    3. Sharing settings (internal, public, domain allow/block lists)
    4. SPF / DKIM / DMARC and anti‑phishing policies
    5. Context-Aware Access — restrict by IP, device, geolocation
    6. Alerting (webhooks, email, Chat notifications)
  • Automation and integration
    1. Admin SDK, Reports API, Directory API
    2. GAMADV‑XTD3 — exporting logs, auditing sharing, changing forwards
    3. Apps Script / Cloud Functions for scheduled audits
    4. SIEM integration (Chronicle, Splunk, ELK)
    5. Connecting to ticketing systems (Jira, ServiceNow)
  • Best practices and security checklist
    1. Incident Response Playbook (detect → contain → recover)
    2. Communication plan and documentation (reports, logs, chain of custody)
    3. Tabletop exercises, sharing audits, phishing tests
    4. Quick admin checklist (daily / weekly / monthly controls)
  • Bonus (if time allows)
    1. Compliance (GDPR, ISO 27001, SOC 2)
    2. Auditing OAuth apps and restricting app access
    3. Chronicle SIEM mini-lab — ingesting logs and creating detections
Prerequisites:
Basic Google Workspace user knowledge; admin experience with SaaS is a plus.
Schedule:
2 days (9:00-17:00)

Training and learning environment

IT classroom with desks, computer monitors, and a projection screen at the front.
What does the environment for in-person IT courses look like?We hold training courses in our own classrooms equipped with modern computer equipment for each participant and a large projection screen. Each workstation is fitted with a powerful computer for seamless practical exercises, and the environment supports a calm, friendly atmosphere during training.
IT classroom with desks, computer monitors, and a projection screen at the front.
Do I need to bring my own laptop to the classroom IT course?Our training rooms are fully equipped, so you do not need to bring your own laptop. A modern computer with all necessary hardware and software is ready for you at your workstation.
Sample ICT Pro certificate of successful completion of an IT training course.
Will you receive an official certificate after completing an IT course?Yes, upon successful completion of the training course, you will receive an official ICT Pro certificate confirming your participation and acquired technical skills. You can use it to verify your qualifications or add it to your professional profile.
Exterior view of the COMGUARD office building on Sochorova Street in Brno.
Where can you find our training center in Brno?The premises of the ICT Pro training center are located on the 1st floor of the COMGUARD building at Sochorova 38 in Brno. Positioned on the border of Žabovřesky and Komín, the location is easily accessible by both car and public transport.
Exterior view of the Opatov Park office building in Prague, Chodov.
Where can you find our training center in Prague?The premises of the ICT Pro training center are located on the 1st floor of the Opatov Park building at Líbalova 1, Prague 11 – Chodov. The location provides a comfortable environment for your education with convenient access.
Fully equipped kitchenette with a coffee machine, microwave, sink, and shelves with cups and glasses.
What facilities and refreshments are available to you during training breaks?Our training centers feature a fully equipped kitchenette for a comfortable break during your courses. The facilities include a coffee machine, microwave, kettle, and a wide selection of drinks and snacks.
Coffee station featuring an automatic coffee machine, yellow and white cups, glasses, and syrups.
What beverage refreshments are available during your course?A beverage station with a coffee machine, teas, syrups, and water is at your disposal throughout the entire training session. You can enjoy a coffee or another drink of your choice anytime during breaks.
Table with sweet pastries, fruit syrups, a water dispenser, and glasses set up for training participants.
What light refreshments are provided for you during the courses?During course breaks, participants can enjoy light sweet snacks, pastries, and fruit syrups to mix their own drinks. Fresh water dispenser and plates are also available for your convenience.
Wicker baskets filled with packaged savory snacks, sweet biscuits, and snack bars.
Should I bring my own snacks to ICT Pro training?There is no need to. A wide selection of savory snacks, sweet biscuits, and snack bars is available for you during breaks. Boost your energy for all-day focus right inside the training center premises.
Outdoor wooden terrace with green surroundings by the glass building of the training center.
Can you spend training breaks in the fresh air?Yes, an outdoor terrace is available at our training center. During breaks between learning sessions, you can relax in the fresh air in a pleasant green environment.
Spacious outdoor wooden terrace with seating and views of the surrounding area.
Where can you relax during course breaks?Our training center features a spacious outdoor terrace with seating options. During breaks between learning sessions, you can step outside to relax and recharge in the fresh air.