Google has rolled out several security and admin console updates to Workspace that make it easier to protect accounts and respond quickly when staff leave.

• What it is: Google Workspace now supports physical FIDO2 security keys and Bluetooth-connected mobile passkeys as a second authentication factor at the Windows login screen. Accounts can also be deprovisioned instantly the moment an employee leaves or changes roles, and admins can now set devices that don't meet security policy to "warn" staff rather than blocking them outright.
• Who is affected: Any business using Google Workspace with single sign-on, managed devices, or regular staff turnover.
• The risk: Without these features enabled, former employees' accounts can remain active longer than necessary, increasing the risk of unauthorised access.
• What to do: Ask your IT provider to review your offboarding process and consider enabling instant deprovisioning and hardware security keys for higher-risk accounts.

These changes are opt-in, so no action is required immediately, but they are worth enabling if you handle sensitive data.