Google has released two security updates for Google Workspace this week — one that is already active for all users, and one that admins can now configure to close a common security gap.

• Device Bound Session Credentials (DBSC) — now on by default: When a staff member logs in to Google Workspace via Chrome on Windows, their login session is now tied to that specific device. If an attacker steals the login session (a common method to bypass passwords and two-factor authentication), they cannot use it from a different machine. This is enabled automatically — no action required.
• Who benefits from DBSC: All Google Workspace users on Chrome for Windows. Users on other browsers are not yet covered by this protection.
• Global Context-Aware Access for SAML apps — now available: Workspace admins can now apply a single access policy that automatically covers all third-party apps connected to Workspace via SAML (a standard login method used by many business tools). Previously, each app had to be configured individually, meaning newly added apps could be left unprotected.
• Who benefits from global CAA: Businesses using multiple third-party applications connected to Google Workspace — such as project management, accounting, or HR tools that use Google for sign-in.
• What to do: DBSC is already active. For the global CAA policy, Workspace admins can review and configure it via Admin console → Security → Access and data control → Context-Aware Access.

If you would like help reviewing your Workspace security settings, contact your IT provider. Sources: Google Workspace Updates Blog