21 Advanced Protection Program (high-risk users)

Google's Advanced Protection Program is the strictest posture Google offers an account: security keys or passkeys only with no weaker fallback, harder download and app-install checks, and third-party apps with high-risk OAuth scopes shut out unless explicitly trusted. The admin toggle only permits enrollment for an OU or group — each user completes the flow themselves at landing.google.com/advancedprotection, and the user's Security panel is where you confirm it took. It is meant for the cohort an attacker will actually spend money on: executives, admins, journalists and other at-risk staff.

Documentation: Protect users with the Advanced Protection Program ↗

Caveats

Enabling enrollment is not enrollment¹
APP will not complete without a phishing-resistant factor plus a backup²
APP blocks most non-Google apps with high-risk scopes³
2-Step Verification (№1) must be on at the tenant’s top level for APP enrollment to be available at all

Setup steps

open ↗
https://admin.google.com/ac/managedsettings/352555445522/titanium · captured 2026-07-15
Security › Authentication › Advanced Protection Program
Enable user enrollment is Google's default tenant-wide. Confirm it is enabled for the organizational unit or group holding the high-risk cohort (executives, admins, journalists/at-risk staff), and explicitly disable it for OUs that should not enroll.

Advanced Protection Program enrollment = Enable user enrollment (the default) for the high-risk OU; set Disable user enrollment for OUs outside the cohort

Enable user enrollment in the Advanced Protection Program ↗
Security › Access and data control › API controls › App access control
Pre-trust the third-party apps the cohort actually needs: APP blocks apps with high-risk OAuth scopes for enrolled users, and the lever is marking each required app Trusted in the API-controls app-access list (№8). Do it before enrollment, or the cohort's mail clients and integrations stop working the day they enrol.

App access control (№8): each app the cohort requires = Trusted

Control which apps access Google Workspace data ↗
open ↗
https://admin.google.com/ac/users · captured 2026-07-15
Directory › Users
Open a user in the target cohort and confirm the Security panel reports Advanced Protection as On after they complete enrollment at landing.google.com/advancedprotection.

User > Security > Advanced Protection
On

Manage a user's security settings ↗

Ongoing maintenance

requires a human On role changes: enrol newly high-risk staff and note leavers.

How to verify

Ask an enrolled user to open their Google account security page — it should show "Advanced Protection: On". Enrolment is user-visible; no admin access needed.

v0.1.4Prevent policy #17 · #30 ↗