This article outlines the configuration options and user features that make up the teachable moments flow for Google Workspace deployments.

Google Workspace Settings

The settings page is divided into the following sections: 

• Threat Notification
• Phishing Security Tests
• Auto-Remediation
• Email Productivity
• Domain-Wide Delegation (DWD)

Threat Notification 

This section covers the notification emails sent to users when a dangerous and suspicious email is detected.

Dangerous and Suspicious Emails

• Threat Notification Email:
  • Enable or disable sending the user an email notification when a dangerous or suspicious email is detected.
  • When enabled, the notification explains why the email was flagged. The original email is only removed from the inbox if the corresponding Threat Label setting is set to Apply Threat Label and Skip Inbox, Apply Threat Label and Move to Spam Label, or Apply Threat Label and Move to Trash.
  • Otherwise, the original email stays in the inbox, and the notification arrives alongside it.

Labels

Each label gives users instant visual identification of a specific type of email. The following category tags are available:

• First Time Sender Label
• Financial Label
• Sensitive Label
• Impersonation Label
• Threat Notification Label

For the First Time Sender, Financial, Sensitive, and Threat Notification labels, choose when the label is applied to a matching email:

• Always Show: Applies the label to every matching email, regardless of the email's threat verdict.
• Disabled: No label is applied.
• Show Only if Suspicious: Applies the label only to emails that Defend assess as Suspicious or Dangerous.

Phishing Security Tests

This setting doesn't change how Defend detects phishing security tests. It only changes how a detected test is classified.

Choose how Defend classifies phishing security test emails:

• Disabled (default): Defend classifies the email as it normally would.
• Benign: Applies External-level labels and actions to the email.
• Suspicious: Applies Suspicious-level labels and actions to the email.
• Dangerous: Applies Dangerous-level labels and actions to the email.

Phishing simulation emails keep their label and stay in the inbox, even if an Auto-Remediation action would otherwise move the email out of the inbox.

For more information, see the Defend | Google Workspace Best Practices for Phishing Security Tests article.

Email Productivity

Helps reduce inbox clutter by identifying graymail and spam. Depending on the option you choose, Defend labels these emails and can also move them out of the inbox.
 

Configure the Graymail Label and Spam Label independently:

• Graymail Label:
  • Disabled: No label is applied.
  • Apply Label and Leave in Inbox: Applies the Graymail label, and the email stays in the inbox.
  • Apply Label and Skip Inbox: Applies the Graymail label and moves the email out of the inbox.
• Spam Label:
  • Disabled: No action is taken.
  • Apply Spam Label and Skip Inbox: Applies Gmail's Spam label and moves the email out of the inbox.

Domain-Wide Delegation (DWD)

Domain-Wide Delegation (DWD) must be verified in your Google Workspace admin console for Defend to function. This status check runs automatically when the Settings page loads.

If DWD isn't yet verified, select How to configure Domain Wide Delegation for step-by-step instructions, including:

1. A link to open the Google Workspace admin console's Domain-Wide Delegation page.
2. The Client ID to add as a new API client, with a Copy button.
3. The required OAuth Scopes to grant, with a Copy button.
4. A reminder to save your changes in the Google Workspace admin console, then select Re-check to verify.

User Experience

This section outlines the user-facing features added as part of the post-delivery teachable moments flow.

Labels

Based on Defend's analysis, incoming emails from outside your organization have a colored label applied. The label's color corresponds to its associated threat level. Labels can be selected to view all emails categorized under that label.

The following colors and labels may be added to emails:

• Gray: Graymail, Spam
• Blue: First-time sender, Impersonation, Financial, Sensitive, Threat Notification
• Amber: Suspicious
• Red: Dangerous*

*You may never see a Dangerous label if your admin configured settings to skip the inbox, move to spam, or move to trash for dangerous emails.

Threat Notification

If configured by your admin, Defend may send threat-notification emails to help you recognize phishing attempts. These emails arrive after Defend identifies an email as Suspicious or Dangerous and are marked with a blue label in your inbox.

Threat-notification emails contain the following information and options:

• Original email details
  • Subject
  • From address
  • Sent time
  • Sender location
  • Sender relationship history
• Email Analysis Summary
  • Provides up to five reasons why Defend thought the email could be a phishing attack.
• Report buttons
  • Report the original email as "Phish". This is only available for emails identified as Suspicious.
  • Report the original email as "Not Phish".