rise - blog - kn

Gmail vs. Outlook vs. Apple Mail in 2025: Unlocking security and productivity for Canadian SMBs

Christian Newman — Sat, 16 Aug 2025 04:00:00 GMT

TL;DR: Don’t sacrifice security and productivity for a simple email client. Switch to Gmail: a secure, AI-powered collaboration hub with integrated calendar, documents, chat, meetings and more.

In today's digital landscape, your email platform isn't just a communication tool; it's a critical component of your cybersecurity posture and overall productivity.

While there are many options out there, for organizations running on Google Workspace, Gmail consistently stands out as the superior choice. But the real game-changer isn't just using Gmail, it's about experiencing it through its native web and mobile applications, rather than third-party clients like Outlook or Apple Mail.

Read all the way to the end for a detailed side-by-side comparison of Gmail to third-party mail clients like Outlook and Apple Mail.

The real cost of neglecting email security

Let's talk numbers, because for Canadian businesses, the cost of a security breach is a serious concern. According to IBM's annual Cost of a Data Breach Report 2024, the average cost of a data breach for Canadian organizations in 2024 was a staggering CA$6.32 million. And the trend isn't slowing down: projections for 2025 suggest this average could rise to CA$6.98 million (as per the IBM Report: Canadians' Data Security Under Increased Threat, While Breach Costs Surge). This isn't just a large enterprise problem; studies by organizations like Coalition and BDC reveal that a significant majority of Canadian small businesses—up to 86% in the last five years—have experienced a cyberattack, with a staggering 61% reporting phishing attempts via email. These breaches can cripple operations, damage reputations, and lead to substantial financial losses that many SMBs simply can't absorb.

To underscore this risk, consider that over 90% of targeted cyberattacks start with a phishing email, as highlighted by cybersecurity firm Proofpoint. This makes your email platform the primary gateway for potential threats.

This is where Gmail, powered by Google's robust security infrastructure, provides an unparalleled advantage – an advantage that's fully realized when you use the dedicated Gmail experience.

My Journey: Unlocking Google Workspace potential with native Gmail

As a Google Workspace administrator for my own organization, and more importantly, as a dedicated Google Workspace Partner, I've had the privilege of supporting numerous Canadian businesses in enhancing their Google Workspace environments.

A common scenario we encounter when onboarding new clients is their users accessing Gmail via familiar, yet limiting, third-party email applications like Outlook or Apple Mail. They simply point these clients to their new Gmail service, believing they're getting the full benefits. However, in doing so, they are unwittingly limiting their team's productivity and, crucially, putting their company data at unnecessary risk.

Third-party clients like Outlook, and Apple Mail, act as a separate layer, unable to fully leverage Google's sophisticated AI-powered security features, real-time alerts, or the seamless, integrated experience of Google Workspace.

I've seen firsthand how crucial productivity features like Smart Compose, Smart Reply, and the integrated Calendar and Meet functionalities are either diminished or entirely absent outside of the native Gmail interface. More critically, the multi-layered, adaptive security Google provides, which learns and responds to emerging threats, isn't fully utilized, leaving users more vulnerable to phishing and malware that the native Gmail experience is designed to block at the edge.

The good news? After guiding these clients and their users to switch to the native Gmail web and mobile apps, they've universally embraced the change. The peace of mind from enhanced security and the tangible gains in operational efficiency through improved productivity and collaboration become evident almost immediately. This shift has consistently allowed both my own organization and our clients to spend less time reacting to threats and more time focusing on growth.

Using Outlook or Apple Mail opts-in to security risks, and opts-out of productivity gains.

Gmail's security advantage

While third-party clients can connect to your Gmail account, they often act as a separate layer, potentially missing out on critical features and the full security suite offered by Google's native applications. Here’s why embracing the native Gmail web and mobile app is the smart choice for your Canadian business from a security standpoint:

Real-time safety warnings: The native Gmail interface provides immediate, prominent warnings directly within your inbox for suspicious emails, links, and files. This includes clear alerts for unverified senders, potentially dangerous attachments, and unusual login attempts, empowering you to make informed decisions before clicking or interacting.
Proactive malware and ransomware protection: Gmail's native client actively protects you from malware and ransomware by not downloading potentially harmful attachments to your device. When you receive an attachment, Gmail allows you to preview it on the web, eliminating the need to download and open it in a local application where it could infect your machine. From there, web-based attachments can open fully in web apps (such as Google Docs, Sheets, or Slides) where users remain safe from harmful content. Plus, if an attachment or link is still deemed suspicious after Google's continuous, AI-powered scanning, you'll see prominent safety warnings, keeping your device and data safe.
Risk of data exfiltration with third-party mail clients: When users access Gmail through third-party mail clients (like Outlook or Apple Mail), a full copy of all emails and attachments are downloaded and stored locally on their device. This creates a significant risk of data exfiltration. If the device is personally owned, sensitive company data remains accessible on their device by default, outside of your organization's control, leading to potential data breaches and compliance issues.
Data Loss Prevention (DLP): For organizations with Data Loss Prevention policies enabled by their Google Workspace administrators, the native Gmail environment provides direct feedback to users. If users attempt to send an email containing sensitive company information (e.g., credit card numbers, personal information, or proprietary data) that violates your organization's policies, Gmail will immediately warn them or even block the email from being sent. This acts as a real-time safeguard, helping avoid accidental (or intentional) data breaches, while ensuring compliance.
Confidential Mode for sensitive emails: Gmail's Confidential Mode is a powerful, user-friendly feature for sending highly sensitive information. Users can set an expiration date for messages and attachments, and even revoke access at any time, directly from their Gmail mailbox. Recipients cannot forward, copy, print, or download the message content, adding a crucial layer of control and security for your most private communications.
Always up-to-date protection: Unlike desktop clients that may require manual updates or can lag behind the latest threat intelligence, the native Gmail web and mobile apps are continuously and automatically updated by Google. This ensures that the security features you interact with are always on the cutting edge, adapting in real-time to new threats without any intervention required from you or your IT team.
Administrator control and consistent policy enforcement: Google Workspace administrators can enforce robust security policies, such as two-factor authentication, suspicious login monitoring, advanced phishing protection, and context-aware access (such as blocking compromised devices or foreign access) which are seamlessly applied and consistently experienced across the native Gmail web and mobile apps. This centralized control ensures that all users benefit from the same high level of protection, simplifying your organization's security posture.

Gmail's productivity advantage

Beyond security, the native Gmail experience significantly enhances your team's ability to work efficiently and collaboratively:

Gemini: Leverage the power of Google's AI assistant, Gemini, directly within your Gmail experience. Gemini can helps summarize long email threads, draft replies, generate content, and even find information from previous emails, Calendar or Google Drive files, significantly reducing time spent on routine tasks and boosting overall efficiency.
Integrated productivity hub: The native Gmail app isn't just an email client; it's an integrated hub for your entire Google Workspace. Directly from your Gmail inbox, you can:
- Manage Google Calendar: See your schedule, create new events, and even accept meeting invites without ever leaving Gmail.
- Initiate Google Meet calls: Jump into a Google Meet call instantly with colleagues or clients.
- Seamlessly add Google Drive attachments: Easily attach files from your Google Drive directly to your emails, without needing to switch apps, copy and paste a link. This not only saves time, but also allows you to control sharing permissions (view, comment, edit) directly from Gmail, ensuring recipients have the right level of access from the moment you send the email.
- Collaborate on Google Docs, Sheets and Slides: Respond to comments, suggestions, sharing requests, and seamlessly open and work on attachments in Google Docs, Sheets, Slides, often with real-time co-editing, directly from your Gmail mailbox.
- Utilize smart features: Beyond Gemini, benefit from AI-driven tools like Smart Compose (predictive writing), Smart Reply (suggested quick responses), and Nudges (reminders for unanswered emails) that are deeply embedded in the native experience to save time and boost efficiency. These features are often diminished or unavailable in third-party clients.
- Enjoy a consistent user experience: Whether your team is on a desktop web browser, an Android device, or an iPhone, the native Gmail app provides a consistent, intuitive, and feature-rich experience. This reduces training overhead and ensures everyone benefits from the latest updates and security enhancements immediately.
Dynamic and flexible labels: While third-party mail apps limit users to an outdated single-folder system for organizing emails, Gmail improves email organization and automation by allowing users to apply multiple labels so they don’t have to decide if an email belongs in a client folder, project folder, or “urgent” folder - they can apply all three labels, instead!
Unified mobile inbox: Just like third-party mail apps, Gmail users can enjoy the convenience of a single view for all their inboxes on their mobile device.
Consistent user experience: Whether your team is on a desktop web browser, an Android device, or an iPhone, the native Gmail app provides a consistent, intuitive, and feature-rich experience. This reduces training overhead and ensures everyone benefits from the latest updates and security enhancements immediately.

The clear choice for robust security and greater productivity

For Canadian small and medium-sized businesses and Google Workspace administrators, choosing the native Gmail web and mobile app offers a comprehensive solution. It not only defends against the escalating threat of cyberattacks (which can cost millions) but also significantly enhances daily productivity by integrating your entire workflow into one intuitive platform. It's an investment in the security, efficiency, and future growth of your organization.

If you're looking to fortify your defences, empower your team to do more, and truly unlock the full potential of your Google Workspace investment, it's time to fully leverage the power of Gmail's native experience. Schedule a no-cost consultation with one of Rise Digital’s Google Workspace experts to discuss how we can help.

For a detailed side-by-side comparison of features across Gmail, and third-party mail apps like Outlook, and Apple Mail, check out our dedicated document: Gmail vs third-party mail apps.

Can Google Workspace admins view user emails? The ultimate guide.

Christian Newman — Sat, 21 Sep 2024 04:00:00 GMT

As a Google Workspace admin, it’s your responsibility to safeguard your organization's data, support business continuity, and ensure compliance with company policies. Sometimes, this requires you to access emails and other user data.

For example:

You’re troubleshooting a technical or security issue
You need to access critical information in the mailbox of a user who’s on vacation or leave
You’re performing an audit to ensure compliance with company policies or regulations
You’re investigating a sensitive matter concerning a specific customer or employee

In this comprehensive guide, we'll explore the various ways Google Workspace admins can view user emails, the pros and cons of each method, in addition to the ethical and privacy considerations involved.

It's critical to understand the methods available and their implications. Whether you're troubleshooting an issue, conducting an audit, or investigating a security incident, this post will equip you with the knowledge you need to access user emails responsibly and effectively.

How to view user emails in Google Workspace - a guide for admins

Administrators of Google Workspace have several methods at their disposal to gain access to and view a user's emails.

The choice of method will depend on the specific situation and the Google Workspace edition subscribed to by the organization.

This ultimate guide provides admins with step-by-step instructions for each method, empowering you to effectively access user emails in accordance with business requirements.

Email log search

Email Log Search offers a non-intrusive way to investigate email activities without directly accessing the content of the messages. It allows admins to search and analyze email logs, providing valuable insights into email traffic patterns, potential security threats, and compliance issues. This method is available to all Google Workspace editions.

Step one: Find emails using Email Log Search

Sign-in to the Google Admin console.
In the navigation menu on the left, click Reporting then Email log search.
Select predefined search to search all emails, or custom search to search emails of a specific date range, user, sender, recipient or subject.
Enter the user’s email address in the Sender email or Recipient email field, in addition to any other relevant search criteria.
Click Search.
Results will display beneath the search button. Click on a result to reveal details of the email, including date, time, size, number and size of attachments, other recipients, and delivery status - but not its contents.

Pros

Non-intrusive
Find specific emails quickly and easily
Available to all Google Workspace editions
Export search results to Google Sheets for analysis
Identify opportunities to coach-back to users on email security best practices
Track email activity and identify potential compliance, deliverability or security issues

Cons

Email contents aren’t visible
Can be time-consuming to use, and challenging to interpret the results
Messages sent from a group email address don’t include information about message delivery to individual group members
Messages older than 30 days the complete recipient email address and the message ID of message(s) you wish to audit, cannot display results for a Google Group email address, and display message post-delivery status only (message delivery status is not available)

Password reset

Resetting a user's password is the most straightforward method for accessing their email account. However, it's essential to use this method sparingly, as it can impact the user's workflow and raise privacy concerns. This method is available to all Google Workspace editions.

Step one: Reset the user’s password

Sign-in to the Google Admin Console.
In the Google Admin console, search for the user whose mailbox you require access to.
From the user’s account in the Admin Console, click Reset password in the list of quick actions below their name.
In the Reset password dialog box that appears, select Automatically generate a password, then click Reset.
Copy the generated password, store it somewhere safe (we recommend a password manager like 1Password), then click Done.
From the user’s account in the Admin Console, click Security, then Require password change, and switch it OFF, otherwise you’ll be required to set a new password the moment you sign into the user’s account.
Scroll up to 2-step verification. If the user has 2-step verification ON, then you’ll also need a backup verification code in order to sign-in to their mailbox. In this case, click Get backup verification codes, copy an unused backup verification code, and store it somewhere safe.

Step two: Sign-in to the user’s account

In Google Chrome browser, open a new Incognito window. Signing-in to the user’s account in an Incognito window will ensure that it does not interfere with your user account.
Sign-in to the user’s mailbox at mail.google.com using the credentials recorded in prior steps.
Search for the email messages you need to access or audit. For more information about Gmail search, check the official article Search in Gmail.
Once your audit is complete, sign-out of the user’s account, and close the Incognito window.

Step three: Restore user access

From the user’s account in the Admin Console, click Security, then Require password change, and switch it ON, so they’ll be required to set a new password the moment they sign into their account.
Supply the user with the password you used to access their account, and instruct them to set a new password upon sign-in.

Pros

Available to all Google Workspace editions
Full access to the user’s Gmail mailbox and other Google Workspace services makes it easy to perform broad or non-targeted audits

Cons

User is aware their account is being scrutinized
User may feel their privacy has been compromised
Messages that have been permanently deleted cannot be audited
Process must be repeated each time mailbox access is required by the administrator
User access to their account will be unavailable from the time their password is reset, to the time the audit is complete
Full access to the user’s Gmail mailbox and other Google Workspace services makes it easy to accidentally expose potentially sensitive information not relevant to the audit

Gmail mailbox delegation

Gmail mailbox delegation is a (potentially) less-intrusive way to directly access emails directly from the user’s mailbox. This method provides full access to the user’s mailbox, which makes it easy to perform broad or non-targeted searches, but also risks unnecessary exposure to potentially sensitive information. This method is available to all Google Workspace editions.

Step one: Enable Gmail mailbox delegation

Sign-in to the Google Admin Console.
Navigate to Apps / Google Workspace / Gmail / User settings, then click on Mail delegation.
Ensure Let users delegate access to their mailbox to other users in the domain is selected (on). If you wish to leave this off, you can turn it on for a specified organizational unit, or group, only, if desired.

Step two: Delegate the user’s Gmail mailbox

In order to delegate a user’s mailbox, the admin must either sign-in to the user’s mailbox, and delegate the mailbox to themselves (or another user), or delegate the mailbox remotely using free and open-source command-line tool for Google Workspace admins, Google Apps Manager (GAM).

Signing into the user's mailbox in order to delegate the mailbox to the admin (or another user) is an equally-intrusive extension of the password reset method, above, with one additional step. The only difference is that mailbox delegation can persist beyond initial mailbox access, enabling future audits.

To avoid repetition, this guide focuses on remote mailbox delegation using GAM, instead.

Install Google Apps Manager (GAM).
Run the following command: gam user user@domain.com create delegate admin@domain.com

Step three: Access the user’s Gmail mailbox

Sign-in to Gmail.
Click on the account switcher and select user@domain.com (delegated)
Perform the audit.

Step four: Un-delegate the user’s Gmail mailbox

Run the following GAM command: gam user user@domain.com delete delegate admin@domain.com

Pros

Available to all Google Workspace editions
User account access is uninterrupted while the audit is being performed
If delegated via GAM, the user may be unaware their account is being scrutinized
Full access to the user’s Gmail mailbox (but not other Google Workspace services) makes it easy to perform broad or non-targeted audits
Gmail mailbox delegation can be persistent (process need not be repeated each time mailbox access is required), although users can remove the delegation anytime via Gmail settings

Cons

Messages that have been permanently deleted cannot be audited
Mailbox delegations are visible to the user, and revocable, via Gmail settings
Accidental changes to the user’s mailbox could further reveal to the user that their mailbox has been accessed by someone other than themselves, and could be under scrutiny:

Drafted, sent or received messages
Messages marked read or unread
Labelled, unlabelled, or reorganized messages
Changes to mailbox settings

Full access to the user’s Gmail mailbox and other Google Workspace services makes it easy to accidentally expose potentially sensitive information not relevant to the audit

Gmail content compliance rule

Gmail content compliance rules are a non-intrusive way of monitoring future emails sent to or from a user’s Gmail mailbox by blind-copying (BCCing) an email address the admin (or others) can monitor. This method is available to all Google Workspace editions.

Step one: Create a Gmail content compliance rule

Sign-in to the Google Admin Console.
Navigate to Apps / Google Workspace / Gmail / Compliance, then click on Content compliance.
Click Add another rule and enter a name for the rule.
In section 1, select which messages you want to monitor: Inbound, outbound, internal - sending, internal - receiving, or any combination thereof.
In section 2, add any or all expressions that match the content (sender, recipient, subject, body, headers etc) of emails you need to monitor for, or select a predefined content match, if available.
In section 3, select Modify message then Add more recipients and enter the email address of the user or group you’ll use to monitor the specified messages.
When the audit is complete, disable or delete the Gmail content compliance rule.

Pros

Available to all Google Workspace editions (except Predefined content match expressions, which require Google Workspace Enterprise Standard or Plus)
The user is unaware their account is being scrutinized (unless those monitoring their email messages accidentally reply)
User account access is uninterrupted while the audit is being performed

Cons

Only future emails can be monitored
Content compliance rule may be visible to other administrators
Accidental replies to monitored messages may reveal to the user that their emails may be accessible to someone other than themselves, and other recipients
Overly-broad rule criteria could result in false positives that accidentally expose potentially sensitive information not relevant to the audit, while overly-narrow rule criteria could result in false negatives that accidentally exclude potentially relevant information, and adjustments to the content compliance rule only improve accuracy of the audit for future emails

Google Vault

Google Vault is Google Workspace’s integrated e-discovery and retention tool. Google Vault helps organizations ensure compliance by retaining or purging data according to regulations and contractual requirements, as well as investigating, and defending themselves, when matters arise.

As a result, Google Vault is one of the best options for auditing, investigating, and monitoring a user’s Gmail mailbox - even messages the user has deleted, subject to retention policies. Not only admins audit, investigate or monitor a single user’s Gmail mailbox, but also multiple users, plus Calendar, Chat, Drive, Groups, Meet, Sites, and Voice, as well.

This method is available for the following Google Workspace editions: Google Workspace Business Plus, Enterprise Standard, Enterprise Plus, Education Standard, Education Plus, and Frontline Standard.

Step 1: Create a matter in Google Vault

Sign-in to Google Vault and click on Matters.
Click Create then enter a name and description of the matter (which will be available to other Vault admins), then Create again.
On the Search tab, choose the service you want to search, then enter the desired search criteria (or no criteria at all, to investigate all content), and click Search.
Review the search results (including email contents in the panel on the right) and adjust the search criteria if needed based on investigation requirements. Once satisfied with the search results, click Save to avoid having to recreate the search in the future.
Specific emails can be exported to PDF via the print icon in the top-right of the email contents, or an export of all search results (in MBOX or PST format) can be created from the Export tab.
Optionally share the matter with other Vault users by clicking on the share icon in the top right of the search results.

Pros

Results include full message contents
Results include messages deleted by users, subject to retention policies
Discreet auditing process, 100% undetectable by the scrutinized users
Search for and investigate matters that span multiple users and/or content types quickly and easy
Role-based access control, safeguarding sensitive data by granting personalized access to authorized users
Automated data retention via set policies, ensuring necessary data is retained and unnecessary data is purged
Advanced search functionality yields results that are broad or specific as needed to satisfy investigative requirements without unnecessarily exposing irrelevant and potentially sensitive data
Matters can easily be shared with internal users, and results can easily be exported to external parties (e.g. accountants, auditors, insurance adjusters, legal counsel) in bulk

Cons

Useful for auditing and investigations only; no ability to take actions on search results (such as delete, quarantine, restore the message, and mark it as phishing or spam)
Only available in specific Google Workspace subscriptions

Security Investigation Tool

The Google Workspace Security Investigation Tool is a powerful tool that empowers admins to investigate and take action on security and privacy issues within their domain, including auditing email usage. While the Security Investigation Tool is available with Google Workspace Enterprise Standard, Enterprise Plus, Education Standard, and Education Plus, the Gmail log events and Gmail messages are only available with Google Workspace Enterprise Plus or Education Plus.

Step 1: Create a Security Investigation Tool investigation

Sign-in to the Google Admin Console.
Navigate to Reporting / Audit and investigation / Gmail messages.
Click Add condition to use and/or conditions to narrow your search as needed to satisfy investigative requirements.
Click Search.
Review search results and adjust conditions as necessary.
Click on the subject line of an email message to view message headers on the Message headers tab.
Click on Message to view the contents of the email message, after entering a business justification for doing so.
If desired, click the corresponding link at the bottom of the message panel to delete the message, restore the message, mark the message as spam or phishing, and send it to inbox or quarantine.
If desired, return to the search results to export them to Google Sheets for further analysis.
If desired, save the investigation for future auditing or reference.
If desired, share the investigation with other admins.

Pros

Results include full message contents
Results include messages deleted by users, for up to 6 months
Discreet auditing process, 100% undetectable by the scrutinized users (unless actions are taken on emails being scrutinized)
Search for and investigate matters that span multiple users quickly and easy
Advanced search functionality yields results that are broad or specific as needed to satisfy investigative requirements without unnecessarily exposing irrelevant and potentially sensitive data
Investigations can easily be shared with other admins, and results can easily be exported to Google Sheets
Actions can be taken on search results in order to maintain security or compliance

Cons

Audit logs only retain data for up to 6 months (unless Big Query auto-export is used to retain longer)
Actions taken on emails in search results may indicate to users that their emails are being scrutinized
Only available in specific Google Workspace subscriptions

Is it ethical to view Google Workspace user emails?

Respecting user privacy builds trust and helps maintain a healthy work environment. However, it’s important to remember that data within company Google Workspace accounts, which can often be sensitive, ultimately belongs to the organization.

Therefore, while Google Workspace admins have the technical means to access user emails, it's crucial to exercise this power responsibly and ethically.

Accessing data in user accounts should only be done when there is a legitimate business justification for doing so - such as investigating security breaches or threats, ensuring business continuity or compliance with organizational policies, and troubleshooting critical issues.

Every organization needs clear policies outlining the circumstances under which admins can access user data, and these policies should be communicated to all employees.

It’s important that admins:

Narrow their search as much as possible to satisfy investigative requirements without risking unnecessary exposure to irrelevant and potentially sensitive information.
Maintain a log of access to user data, including the date, time, target account, data accessed, business justification, and the name of the person who requested, or approved the account access.
Consult with their legal team when in doubt, and always adhere to local laws and regulations regarding data privacy and employee monitoring.

Google Workspace admins have a range of tools at their disposal to view user emails, each with its own advantages and disadvantages. The choice of method depends on the specific situation, the level of access required, and the Google Workspace edition in use.

It's crucial to remember that accessing user emails is a sensitive matter, and admins must always prioritize user privacy and adhere to legal and ethical guidelines. By understanding the available methods and their implications, admins can strike the right balance between safeguarding their organization's data and respecting user privacy.

Get Google Workspace investigation help

If you’re conducting an investigation and need help finding the information you need, while striking a balance between business requirements and user privacy, book a no-cost consultation with us.

Have you faced similar challenges with Google Workspace investigations? Reach out, and share your experiences with us!

Google Workspace shared drive migration problem solved

Christian Newman — Tue, 02 Apr 2024 04:00:00 GMT

With due diligence and planning, migrating data to Google Workspace shared drives can be a smooth process, but when you're dealing with large or complex folder structures, unexpected hiccups can grind your best efforts to a halt. Knowing some of the potential pitfalls ahead of time can help ensure your migration is a success.

A cautionary migration tale: Hidden files and unexpected errors

A recent 85-user Google Workspace customer had a troubling experience when migrating a large folder structure from My Drive to a shared drive. The migration appeared to pass Google Drive's pre-migration checks for unmovable items, yet it inexplicably failed mid-process.

The result was a real mess: duplicated folders with broken permissions on both the source (My Drive) and destination (shared drive). Files were left inaccessible to users, and business processes were impacted - with countless “empty” folders (due to a combination of broken permission inheritance and files orphaned from their parents).

Understanding shared drive limitations: What can and can't be moved

It's a good idea to familiarize yourself with Google Drive's migration limitations around what can and can’t be moved to a shared drive.

What can be moved to a shared drive?

Files and folders that you (or whoever’s doing the move) own
Files and folders where you (or whoever’s doing the move) has editor or contributor permissions - or, in the case of an admin who’s performing the move, viewer permissions

What can't be moved to a shared drive?

Externally-owned items: Files and folders owned by people outside your organization - unless you first obtain ownership, or create copies of them (or shortcuts to them, or both), then move the originals out of the folder structure to be migrated
Items with insufficient permissions: Files and folders where you don't have the necessary permissions (i.e. editor, or as an admin, viewer access)

It’s also a good idea to familiarize yourself with the limitations of the tools that are available to you to investigate what went wrong, just in case you run into an issue:

Limited Audit Logs: Drive's audit logs only go back 6 months, making it hard to trace what happened if an older issue is causing a roadblock.

Even if everything seems ready, there might be hidden factors that can trip up your migration process, such as hidden files flagged as inappropriate by Google.

Troubleshooting unmovable files: Finding the culprits

Our investigation process for our customer went as follows:

Damage control: We focused on restoring file visibility to minimize business disruption while we worked on a long-term solution.
Preparing for round 2: Externally owned items were addressed by creating internally-owned copies and safe-harbouring the originals in a different folder structure to streamline the process for another migration attempt.
Divide and conquer: We broke down the migration into smaller chunks. This helped us isolate the subfolders that were causing problems – turns out Drive couldn't report on hidden files flagged as inappropriate by Google (CSV reports provided by the unmovable item notification were blank).
Unmasking the mystery: Painstakingly, we used drag-and-drop with individual subfolders to zero in on the problem. Still unsure why the error occurred, we had to dig deeper.

The power of GAM: Uncovering hidden issues

GAM (or more accurately, GAMADV-XTD3, the free command-line admin tool for Google Workspace) was our lifesaver!

We scanned a problem folder, printing a filelist from the perspective of all users. This is when we found it – the .DS_Store file generated by macOS, hidden and flagged as inappropriate. This known 2022 (and earlier) issue had brought the entire migration to a screeching halt.

Deleting the hidden file and doing a GAM sweep for similar culprits allowed the migration to proceed flawlessly.

Beyond the basics: Seemingly benign files can cause problems

It's surprising but true: Google can sometimes inadvertently flag common file types as inappropriate.

Keep an eye out for .DS_Store files along with other sometimes problematic types (e.g., some video or image formats which can trip up the copyright police).

Key takeaways

Google Drive’s pre-migration checks can overlook issues: Don't fully rely on them. Hidden files flagged as inappropriate by Google may be detected, but may not be show up in Drive’s downloadable report.
GAM is your friend: Get comfortable with this powerful tool for troubleshooting hidden problems.

Questions about the shared drive migration process?

If you're planning a migration or want to ensure your Google Workspace experience is silky-smooth, book a no-cost consultation with us.

Have you faced similar challenges with Google Workspace migrations? Reach out, and share your experiences with us!

Prevent Emails From Being Delivered to Spam With SPF

Christian Newman — Fri, 11 Nov 2022 05:00:00 GMT

Combining Google Workspace’s secure-by-design architecture with Gmail’s built-in spam, phishing, and malware protection prevents 99.9% of malicious messages from entering your users’ inboxes.

You might be thinking, “that’s great, but how can I prevent our outgoing emails from going to spam?”

That’s where SPF comes in.

Do you have an SPF record? 🚨

SP-what? 🤔

Sender

Protection

Framework

Without an SPF record, recipient mail servers are unable to authenticate whether your outgoing emails are being sent from an authorized source.

Domains that send email risk poor deliverability - dramatically increasing the chances of their outgoing mail being labeled as spam, potentially malicious, or being outright rejected by recipient mail servers.

Worse, they leave the door wide-open for third parties to spoof (or impersonate) their domain to:

Launch phishing attacks 🎣
Distribute spam, malware or ransomware ☣️
Run social engineering scams against customers or employees 💸

An accurate SPF record helps administrators ensure that recipient mail servers can confirm the authenticity of mail sent from your domain.

In other words: 👏🏼 100% 👏🏼 of companies need an SPF record to help optimize email deliverability, protect their brand and domain reputation. Every Rise Digital Google Workspace client is set up with an SPF from day one ☝🏼

How does SPF help improve email deliverability and security?

SPF specifies the servers (IP addresses) and domains (e.g. google.com) that are authorized to send email on behalf of your organization.

Upon receiving mail from your domain, recipient mail servers will compare the outgoing mail server to the list of authorized servers and domains listed in your domain’s SPF record.

Mail that pass SPF are more likely to be delivered to inboxes.

Mail that fail SPF are more likely to be delivered to spam, labeled as malicious, quarantined, or rejected.

How do I enable SPF?

There are four (4) steps to enabling SPF.

1. Identify authorized mail senders

Identify and build a list of all domains and IP addresses who send mail on behalf of your domain, including all users and services (such as applications, email marketing platforms, websites, on-premise and cloud-based servers, etc).

2. Define your SPF record

Your SPF record specifies which domains and IP addresses are authorized to send email on behalf of your domain.

Once your SPF record is in place, mail sent by domains and IP addresses not listed in your SPF record will be marked as spam or potentially malicious, and could even be quarantined or rejected.

To avoid potential disruption to mail flow, it’s important to ensure your SPF record includes all authorized domains and IP addresses.

A basic SPF record looks like this:

v=spf1 include:_spf.google.com ~all

… where include:_spf.google.com permits Google Workspace servers to send mail on behalf of your domain, and ~all permits mail sent by non-Google Workspace servers to be delivered, but marked as spam or potentially malicious.

A more advanced SPF record that includes additional domains and IP addresses looks like this:

v=spf1 ip4:192.168.0.0/16 include:_spf.google.com include:sendyourmail.com ~all

… where ip4:192.168.0.0/16 permits servers using a range of IP addresses and include:sendyourmail.com permits a third-party service sendyourmail.com to send mail on behalf of your domain.

Sender Protection Framework (SPF) includes a number of additional mechanisms and qualifiers you can use to refine your SPF record to tell receiving mail servers how to handle messages sent using your domain.

3. Add your SPF record to your domain registrar’s DNS console

To implement your initial SPF record:

Sign into your domain registrar’s DNS console
Verify that no existing SPF record exist (only one SPF record is allowed)
If an existing SPF record exists, edit it. Otherwise, create a new TXT record as follows:

Name: @ (or blank)

Value: v=spf1 include:_spf.google.com ~all (or whatever SPF record you defined in step 2, above)

TTL: Default (or 60 minutes, or 3600 seconds

4. Monitor mail deliverability

Once SPF has been implemented, monitor for outgoing messages that:

Fail SPF authentication
Get rejected by recipient mail servers
Are delivered to spam

Any of the above indicate either an error in your SPF record, duplicate SPF records, or that an authorized sender (domain or IP address) is missing from your SPF record.

If this happens, correct the error in your SPF record, and continue monitoring outbound mail.

You can also check the headers of messages sent from your domain to learn if messages are passing SPF. To check message headers in Gmail, click Show original for a message, then check the SPF status in the original message.

5. Implement DKIM and DMARC to further strengthen email security

SPF works alongside two additional email security protocols to optimize mail deliverability while preventing spam, spoofing, phishing and more.

Domain Keys Identified Mail (DKIM) adds a digital signature to every outgoing message, which lets receiving servers verify the message actually came from your organization, and wasn’t modified in transit.
Domain-based Message Authentication, Reporting and Conformance (DMARC) sends you reports containing the source (servers and domains) of messages sent using your domain, what percent of messages fail SPF and DKIM, and advises recipient mail servers what action to take on messages sent by unauthorized senders: Deliver, deliver to spam, or reject.

It’s critical that 100% of companies implement SPF, DKIM and DMARC to protect their brands and domain reputations. Every Rise Digital Google Workspace client is set up with a strong SPF, DKIM and DMARC policy from day one ☝🏼

Congratulations! 🥳

With SPF implemented, your organization will enjoy improved email deliverability and greater email security.

How to Use DMARC to Prevent Spam and Spoofing

Christian Newman — Fri, 04 Nov 2022 04:00:00 GMT

Combining Google Workspace’s secure-by-design architecture with Gmail’s built-in spam, phishing, and malware protections is an excellent way to protect your users from threats originating outside your domain… but what about threats by malicious actors who hijack your own domain to impersonate your users and launch email-based attacks against your customers, employees and brand?

Worse, did you know that anyone on the Internet can send email ‘from’ your domain, and they don’t even need access to your account to do it?

That’s where DMARC comes in.

Do you have a DMARC policy? 🚨

D-what? 🤔

Domain-based
Message
Authentication,
Reporting and
Conformance

Without a DMARC policy, domains that send and receive email leave the door wide-open for third parties to spoof (or impersonate) their domain to:

Launch phishing attacks 🎣
Distribute spam, malware or ransomware ☣️
Run social engineering scams against customers or employees 💸

A strong DMARC policy enables administrators to monitor, quarantine or reject delivery of messages sent using their domain by unauthorized senders.

In other words: 👏🏼 100% 👏🏼 of companies need a DMARC policy to protect their brand and domain reputation. It's so important that every Rise Digital Google Workspace client is set up with a DMARC policy from day one. ☝🏼

How does DMARC work?

DMARC works by performing two functions:

Image source: dmarc.org

First, DMARC sends you reports containing the source (servers and domains) of messages sent using your domain, and what percent of them pass or fail two important mail security protocols:

Sender Protection Framework (SPF), which specifies the servers (IP addresses) and domains (e.g. google.com) that are authorized to send email on behalf of your organization.
Domain Keys Identified Mail (DKIM), which adds a digital signature to every outgoing message, which lets receiving servers verify the message actually came from your organization, and wasn’t modified in transit.

Second, DMARC recommends what action recipient mail servers should take on messages that fail the above protocols (in other words, messages sent by unauthorized senders):

None (deliver the message)
Quarantine (deliver the message to spam)
Reject (bounce the message)

How do I enable DMARC?

The first thing to understand about implementing DMARC is that it’s a process.

To immediately reject 100% of outbound messages that fail DMARC (in other words, fail SPF and DKIM) risks interrupting delivery of business-critical mail sent by your organization’s users and systems every day.

Therefore, we recommend Google Workspace admins take a gradual approach to introducing, then strengthening, their DMARC policy - analyzing the results and monitoring for adverse impacts every step of the way.

Here’s how:

Implement SPF and DKIM for authorized senders.

Your first step is to ensure your organization has implemented SPF and DKIM for mail sent by your domain’s users and other authorized senders (such as your website or email marketing platform.

DMARC instructs mail servers how to handle messages that do not pass SPF or DKIM, so it’s important you ensure they’re enabled, first.

Create a dedicated email address to collect DMARC reports

Once your DMARC policy is in place, you’ll receive reports (in the form of .xml files) from recipient mail servers telling you which domains and servers are sending mail on behalf of your organization (using your domain).

Instead of flooding your own email address with DMARC reports, I recommend creating a dedicated repository in the form of a Google group.

To create your DMARC group:

Sign-in to the Google Admin Console
Navigate to Directory / Groups / Create group
Enter DMARC in Group name, enter dmarc in group email, and enter a description if desired. Do not enter a group owner, and do not check the Security label. Click next.
Set all access settings to Group Owners, except Who can post: External. Set who can join the group to Only invited users and do not allow members outside your organization. Click next, Create group, Done, See group settings, then advanced settings.
Under Posting policies, change Who can attach files to Anyone on the web.

Implement an initial (permissive, or relaxed) DMARC policy

Your DMARC policy will advise recipient mail servers how to handle messages that fail SPF or DKIM, and where to send the reports.

To avoid potential disruption to mail flow for authorized senders (including services you may have overlooked), it’s important not to to take any action on (potentially) unauthorized messages at this stage.

A good initial (permissing) DMARC policy looks like this:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

… where p=none recommends normal delivery of messages that fail SPF or DKIM.

As you gain insight (via DMARC reports and adverse impacts reported by your users, if any) and enable SPF and DKIM for additional authorized senders, you can gradually tighten your policy to quarantine, and eventually reject, messages from unauthorized senders.

To implement your initial DMARC policy:

Sign into your domain registrar’s DNS console
Create a new TXT record as follows:

Name: _dmarc

Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

TTL: Default (or 60 minutes, or 3600 seconds

Analyze DMARC reports

You’ll receive DMARC reports daily.

Within a few weeks, you’ll have enough data to begin analyzing your DMARC reports to understand:

What servers and domains are sending mail from your domain
What percent of messages from your domain pass DMARC (SPF and DKIM)
What servers and domains are sending messages that fail DMARC (SPF and DKIM)

An excellent tool for analyzing DMARC reports is DMARCian’s XML to Human Converter.

Based on your analysis, adjust your implementation of SPF and DKIM to ensure all authorized senders are passing these security checks (and therefore, passing DMARC).

Once you’ve used the information in DMARC reports to optimize your implementation of SPF and DKIM, with no adverse results (like outbound messages bouncing or being delivered to spam) it’s time to tighten your DMARC policy.

Quarantine some, then more, and eventually all messages from unauthorized senders

From this point forward, you’ll tighten your DMARC policy in small increments (the size of which may depend on the size, and therefore potential impact, on your organization, of potential adverse effects on mail delivery).

DMARC policy is tightened by editing the value of the DMARC record you added to your domain registrar’s DNS console.

For example:

v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@yourdomain.com

… where p=quarantine; pct=10 instructs recipient mail servers to deliver 10% of messages that fail DMARC (SPF and DKIM) to recipients’ spam folders. The remaining 90% of messages that fail DMARC will be delivered normally.

Once you’ve adjusted your DMARC policy:

Monitor for adverse impacts
After a few weeks, analyze your DMARC reports
Make adjustments to your implementation of SPF and DKIM, if needed

When no adverse effects are observed and no adjustments to SPF and DKIM are needed, gradually increase the percent of quarantined messages until it reaches 100%, repeating this cycle several times.

Reject messages from unauthorized senders

Once 100% of messages that fail DMARC are being quarantined with no adverse effects, you’re ready to take the final step: rejecting messages from unauthorized senders.

To do so, you’ll make one final edit to your DMARC record:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

… where p=reject instructs mail servers to reject (bounce) messages that fail DMARC - in other words, if messages aren’t being sent by authorized users or systems, they won’t get delivered.

While it is possible for recipient mail servers to override your DMARC policy, it’s rare for them to do so.

Congratulations! 🥳

Now, your organization is best protected against abuse by unauthorized senders spoofing your domain and impersonating your users.

How to Send a Group Email in Gmail

Christian Newman — Wed, 12 Jan 2022 05:00:00 GMT

Hands up if you’ve ever forgotten someone in a group email 🙋🏻‍♂️

Sometimes it’s helpful to be able to email groups of people all at once, without having to remember everyone’s names.

There’s an easy way to send group emails in Gmail, without needing to ask your Google Workspace administrator to create a group in the Admin Console.

To send a group email in Gmail:

Sign into Google Contacts at contacts.google.com.
Click Create label.
Assign a name to the new label and click Save.
Open a contact and click the label icon beneath their name/title to select the new label.
Repeat for additional contacts, or multi-select contacts from the contact list and click the label button at the top to bulk add contacts to a label.
Once all members have been added to the label, sign into Gmail at mail.google.com.
Click Compose.
Type the name of the newly-created label in the To: field and select the contact group when it auto-completes. (Note: Gmail may require a refresh if you already had it open prior to creating the new label, and even then it may also take some time before the new label appears in Gmail.)
Compose your message and click Send.

How to Hide Your Own Video Feed in Google Meet

Christian Newman — Thu, 06 Jan 2022 05:00:00 GMT

Sometimes, when we’re attending an event in Google Meet, we just want to focus our attention on the people we’re meeting with, or the content that’s being presented.

It’s easy to get our own video feed or tile out of the way so we can do exactly that.

To hide your own video tile in Google Meet:

While in a Google Meet call:

Hover over your own video feed and click Remove this tile or Minimize.
Click and hold to drag the You bubble in the bottom right to the desired location.
Hover over the You bubble to expand or show in a tile again.

How to Make Gmail Your Default Email Application

Christian Newman — Fri, 19 Nov 2021 05:00:00 GMT

The native Gmail application in Chrome browser is hands-down the most secure, productive and feature-rich email experience available.

Problem is, when you click email links on the web, most desktop and laptop computers will create a new email message in the operating system’s default email client.

To automatically open email links in Gmail instead of your computer’s default email client, you need to set Gmail as the default email application, instead.

Once you’ve set this up, clicking email links will open the Gmail compose window in a new Chrome tab with a pre-filled To: email address field.

How to make Gmail the default email application on your computer

First, set Chrome as the default email application on your computer:

MacOS

Open the Mail app
Hit ⌘, on the keyboard or click Mail then Preferences in the menu bar
Choose Google Chrome from the Default email reader menu

Windows

Open Settings
Under Apps, click Default Apps
In the right panel, under Email, choose Google Chrome

Second, set Gmail as the default email application in Chrome browser:

In your Chrome Browser's address bar, enter mail.google.com
Click the Service handler icon on the right side of the address bar
Click Allow, then Done

If you don’t see Service Handler in Chrome’s address bar, do the following, then refresh your Gmail tab and try again:

Open Chrome Browser and click More then Settings
Click on Privacy and security
Click Site Settings
Expand Additional permissions
Click Protocol handlers
At the top, select Sites can ask to handle protocols
Scroll down to the Email section and remove mail.google.com if it appears in this list

How to Enable Dark Mode in Google Chat for Desktop

Christian Newman — Tue, 28 Sep 2021 04:00:00 GMT

Organizations who use Google Workspace can practically live in Google Chat.

It’s where team members connect, communicate and collaborate with one another and external partners to get things done in 1-1 direct messages or in collaborative Spaces to discuss teams, projects and more.

Dark mode makes all-day collaboration more relaxing and easier on the eyes. While dark mode was previously available in Google Chat for mobile, Google recently added dark mode to the desktop version of Google Chat.

To enable dark mode in Google Chat for desktop:

Open Google Chat
Click the Settings icon near the top right
Scroll down to Theme settings and select Dark mode
Click Done et voila - Google Chat in dark mode!

For now, sidebar applications like Calendar, Keep and Tasks still appear in Light mode - but let’s hope Google converts them to dark mode too. 🖤

Ready to start using Google Chat?

Stop wasting time and money with other chat applications that require you to install software, keep it up to date, constantly switch contexts, and pay a separate monthly fee.

Google Chat runs on the web in Google Chrome, making it easy to keep up to connect, communicate and collaborate without switching apps. Plus, it’s included in Google Workspace.

If you people need to stay in constant communication with one another - whether from across the office or around the globe, schedule an intro meeting with us so we can tell you more about how Google Chat can help.

How to Create a Gmail Dock Icon or Desktop Shortcut

Christian Newman — Mon, 02 Aug 2021 04:00:00 GMT

Can you guess what’s the first thing people open most mornings?

You guessed it: Gmail!

Perhaps you’re like me, and never close Gmail in the first place. 🙋🏻‍♂️

But I’m not most people, who prefer to shut down at the end of the day so they can enjoy some evening zen. 🧘🏻‍♂️

The next morning, they launch Chrome browser, click on Gmail in the bookmarks bar, or type in mail.google.com. Who’s got time for that?

It’s no wonder so many clients ask: How do I put a Gmail icon on my desktop, in my dock or start menu so I can launch Gmail in one click?

How to create a Gmail shortcut in Chrome browser

Open Gmail by typing mail.google.com into the Chrome URL bar.
Click the More button in the top right of the Chrome window.
Click Cast, save and share.
Click Install page as app. If Install page as app is not available, click Create shortcut.
In the dialog box that appears, name your app or shortcut. For example, Gmail.
If you selected Create shortcut in step 4, above, choose whether you want the shortcut to open as a window. If not, it’ll open as a tab in an existing Chrome window, if there is one.
Click Install or Create.
A Finder (Mac) or Explorer (Windows) window will open, revealing the new shortcut.
Drag the shortcut onto your Desktop, Dock (Mac) or Start Menu (Windows).
Enjoy one-click Gmail access! 😀

You can use Create Shortcut… to create a dock icon or desktop shortcut for any Google Workspace app - or any other website.