Skip to main content
To set up IAM in Google Workspace, you first need to turn on Google Workspace CSE for all users who need to do either of the following activities:
  • Create or upload encrypted files to Google Drive
  • Host encrypted meetings with Google Meet (beta)
You don’t need to turn on CSE for users who only need to view or edit encrypted files or attend meetings. However, external users need to use an identity provider (IdP) allowlisted by your domain. For details, see External user requirements in the About client-side encryption section atsupport.google.com/a/answer/10741897#requirements.
To turn on CSE for users, you must turn on CSE for the organizational units or configuration groups the users belong to. At any time, you can disable CSE for users by turning CSE off for the organizational units or configuration groups they belong to. If you disable CSE for users, any existing client-side encrypted content remains encrypted and accessible. Refer to this Google Workspace knowledge base article ( support.google.com/a/answer/10745596) for instructions on how to perform the following steps for setting up IAM for CSE in Google Workspace:
  1. Set the default key service for your organization
  2. Turn CSE on or off for users