23 Advanced Protection Program (high-risk users)

Google's Advanced Protection Program is the strictest posture Google offers an account: security keys or passkeys only with no weaker fallback, harder download and app-install checks, and third-party apps with high-risk OAuth scopes shut out unless explicitly trusted. The admin toggle only permits enrollment for an OU or group — each user completes the flow themselves at landing.google.com/advancedprotection, and the user's Security panel is where you confirm it took. It is meant for the cohort an attacker will actually spend money on: executives, admins, journalists and other at-risk staff.

Documentation: Protect users with the Advanced Protection Program

Caveats

Enabling enrollment is not enrollment — the toggle only permits it, and until each user completes the flow with two keys, nothing about their account has changed.
2-Step Verification (№1) must be on at the tenant’s top level for APP enrollment to be available at all.

Setup steps

Enable user enrollment is Google's default tenant-wide. Confirm it is enabled for the organizational unit or group holding the high-risk cohort (executives, admins, journalists/at-risk staff), and explicitly disable it for OUs that should not enroll.

open ↗

https://admin.google.com/ac/managedsettings/352555445522/titanium · captured 2026-07-15

Security › Authentication › Advanced Protection Program

Advanced Protection Program enrollment = Enable user enrollment (the default) for the high-risk OU; set Disable user enrollment for OUs outside the cohort

Enrollment will not complete without a phishing-resistant factor plus a backup — order the keys before this toggle matters, or the rollout stalls at the first user.

Enable user enrollment in the Advanced Protection Program
Pre-trust the third-party apps the cohort actually needs: APP blocks apps with high-risk OAuth scopes for enrolled users, and the lever is marking each required app Trusted in the API-controls app-access list (№8). Do it before enrollment, or the cohort's mail clients and integrations stop working the day they enrol.

Security › Access and data control › API controls › App access control

App access control (№8): each app the cohort requires = Trusted

Control which apps access Google Workspace data
Open a user in the target cohort and confirm the Security panel reports Advanced Protection as On after they complete enrollment at landing.google.com/advancedprotection.

open ↗

https://admin.google.com/ac/users · captured 2026-07-15

Directory › Users

User > Security > Advanced Protection

On

Manage a user's security settings

Ongoing maintenance

requires a human On role changes: enrol newly high-risk staff and note leavers.

How to verify

Ask an enrolled user to open their Google account security page — it should show "Advanced Protection: On". Enrolment is user-visible; no admin access needed.

v0.1.4 Prevent policy #17 · #30 ↗