Google has rolled out several meaningful security improvements to Google Workspace this month. If your business uses Gmail, Google Drive, or Google Calendar, these changes are now active on your account.

• Device-Bound Session Credentials (DBSC) - now on by default: From 3 June 2026, this feature is enabled for all Workspace users on Chrome for Windows. It ties your login session to your physical device, so even if malware steals session cookies, attackers cannot use them from another machine. No action is required - this protection is automatic.
• Data Loss Prevention for Google Calendar: Admins can now set rules to automatically detect sensitive information in calendar event titles, descriptions, and locations. This helps prevent confidential details from being accidentally shared through calendar invites. Admins should review the new DLP settings in the Google Admin console.
• Expanded iOS device management: New iOS device management settings are now generally available in Google Endpoint Management, giving admins more granular control over how iPhones and iPads are configured and secured for business use.
• Automated DLP policy management: Admins managing larger Workspace environments can now create, update, and delete data loss prevention rules programmatically via API, enabling automated policy management at scale.

Most of these changes are automatic for Workspace business and enterprise customers. Admins should log in to the Google Admin console to review and configure the new Calendar DLP rules. Source: Google Workspace Updates Blog.