Google Workspace: Admin audit events where strong authentication is allowed without enforcement (MFA disabled)
Alerts on Google Workspace admin changes that set strong authentication/MFA enforcement to false.
FreeReviewedSigma · Medium · v4
- Product
- gcp
- Service
- google_workspace.admin
- Author
- Austin Songer (SigmaHQ), DRL 1.1
- Published
- 2021-08-26
- Updated
- 2026-07-31
What it detects
This rule identifies Google Workspace administrative audit events where strong authentication enforcement is set to false via the Admin SDK security settings. Attackers may try to weaken account protections by disabling MFA enforcement, increasing the likelihood of credential theft leading to account takeover. The detection relies on Google Workspace admin audit telemetry capturing the relevant security-setting change with new_value set to 'false' for the specified event names.
Reporting behind it
- cloud.google.comhttps://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
- developers.google.comhttps://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION
- developers.google.comhttps://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_mfa_disabled.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
google-workspace-admin-api-mfa-enforcement-relaxed-by-setting-to-false-780601d1
title: "Google Workspace: Admin audit events where strong authentication is allowed without enforcement (MFA disabled)"
id: ab0c830e-575d-47c6-95db-cee3ffde37a8
status: test
description: This rule identifies Google Workspace administrative audit events where strong authentication enforcement is set to false via the Admin SDK security settings. Attackers may try to weaken account protections by disabling MFA enforcement, increasing the likelihood of credential theft leading to account takeover. The detection relies on Google Workspace admin audit telemetry capturing the relevant security-setting change with new_value set to 'false' for the specified event names.
references:
- https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
- https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION
- https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_mfa_disabled.yml
author: Austin Songer, Huntrule Team
date: 2021-08-26
modified: 2023-10-11
tags:
- attack.impact
logsource:
product: gcp
service: google_workspace.admin
detection:
selection_base:
eventService: admin.googleapis.com
eventName:
- ENFORCE_STRONG_AUTHENTICATION
- ALLOW_STRONG_AUTHENTICATION
selection_eventValue:
new_value: "false"
condition: all of selection*
falsepositives:
- MFA may be disabled and performed by a system administrator.
level: medium
license: DRL-1.1
related:
- id: 780601d1-6376-4f2a-884e-b8d45599f78c
type: derived