Team: Huntress Managed Identity Threat Detection and Response (ITDR) for Google Workspace (GWS)
Product: Identity Isolation
Environment: Google Workspace
Summary: Understanding Identity Isolation for Google Workspace users
Overview
Identity Isolation currently only supports Microsoft 365 identities. Huntress does not currently isolate Google Workspace (GWS) identities at this time.
Why is this important?
When an identity included in ITDR for Google Workspace is compromised, Huntress will Revoke Access to the account which will result in all currently signed in sessions being signed out.
Due to the nature of suspension steps within Google Workspace, we are currently not isolating further. Suspension within Google will disconnect more than just email services and may be considered excessively disruptive if performed without user knowledge.
If you'd like to see this as a future feature, please let us know in our feedback portal.
What is the suggested step in the event of user compromise?
If you have a user who is compromised and the user account has already been revoked, we would suggest manually suspending the user account in Google Workspace. This will give you an opportunity to review the incident report and speak with the end user about potential next steps as needed.