Google has rolled out a significant security improvement for Google Workspace that protects business accounts from session hijacking — even if a device has been compromised by malware. This update is automatic and requires no action from users.

• What it is: Device Bound Session Credentials (DBSC) is now generally available and enabled by default for all Google Workspace users running Chrome on Windows. The feature ties a login session to the specific device that authenticated, making it significantly harder for attackers to steal and reuse session cookies to access your account.
• Who is affected: All businesses using Google Workspace with Chrome on Windows benefit from this automatically. No configuration is required.
• Other updates this month:
  • Admins can now apply mobile device management controls to both corporate-owned and personally-owned (BYOD) iOS devices through Google Endpoint Management — available from 4 June 2026 for all Workspace customers.
  • New Data Loss Prevention (DLP) policies are rolling out for third-party app attachments and Google Calendar, giving admins greater control over data leaving the organisation.
• What action is needed: DBSC is enabled automatically — no action required. Admins managing iOS devices should review the new Endpoint Management settings in the Google Admin Console to take advantage of the expanded controls.

These are positive security improvements for businesses on Google Workspace. If you would like help reviewing your admin settings or mobile device policies, contact us.

Sources: Google Workspace Updates Blog | Google Workspace Weekly Recap