This article outlines the configuration options and user features that make up the teachable moments flow for Google Workspace deployments.

Google Workspace Settings

The settings page is divided into the following sections: 

• Threat Notification
• Category Tags
• Phishing Simulation Tests
• Email Productivity
• Domain-Wide Delegation (DWD)

Threat Notification and Threat Tags

This section covers controls for threat notification emails and Gmail threat tags for dangerous and suspicious emails.

Dangerous and Suspicious Emails

• Threat Notification Email:
  • Enable or disable sending the user an email notification when a dangerous or suspicious email is detected.
  • When enabled, the notification explains why the email was flagged. The original email is only removed from the inbox if the corresponding Threat Tag setting is set to Add Threat Tag and Skip Inbox or Add Threat Tag and Spam Label.
  • Otherwise, the original email stays in the inbox, and the notification arrives alongside it.

• Threat Tag:

  Choose the action taken when a dangerous or suspicious email is detected:

  • Disabled: No tag is applied.
  • Add Threat Tag: Applies the visual tag only, and the email stays in the inbox.
  • Add Threat Tag and Skip Inbox: Applies the tag and moves the email from the inbox into a separate category.
  • Add Threat Tag and Spam Label: Applies the tag and labels the email as spam.

• Phishing Simulation Tests:

  Controls how Defend classifies emails it identifies as phishing simulation tests.

  The following options are available for this setting:

  • Disabled (default)
  • Benign
  • Suspicious
  • Dangerous

Category Tags

Each category tag gives users instant visual identification of a specific type of email. The following category tags are available:

• First Time Sender Tag
• Financial Tag
• Sensitive Tag
• Impersonation Tag
• Threat Notification Tag

For each tag, choose one of the following delivery options:

• Disabled: No tag is applied.
• Always Send: Applies the tag to every matching email, regardless of the email's threat verdict.
• Send Only if Suspicious: Applies the tag only to emails that Defend assess as Suspicious or Dangerous.

Phishing Simulation Tests

This setting doesn't change how Defend detects phishing simulation tests. It only changes how a detected test is classified.

Choose how Defend classifies phishing simulation emails:

• Disabled (default): Defend classifies the email as it normally would.
• Benign: Applies External-level banners and actions to the email.
• Suspicious: Applies Suspicious-level banners and actions to the email.
• Dangerous: Applies Dangerous-level banners and actions to the email.

For more information, see the Defend | Google Workspace Best Practices for Phishing Simulation Tests article.

Email Productivity

Helps reduce inbox clutter by identifying graymail and spam. When enabled, these emails are labeled and moved from the inbox into the matching category.

Configure the Graymail Tag and Spam Tag independently. Depending on the configuration, flagged emails will either:

• Appear in the inbox with a Graymail or Spam tag.
• Be moved to the Graymail or Junk folder with a Graymail or Spam tag.

Domain-Wide Delegation (DWD)

Domain-Wide Delegation (DWD) must be verified in your Google Workspace admin console for Defend to function. This status check runs automatically when the Settings page loads.

If DWD isn't yet verified, select How to configure Domain Wide Delegation for step-by-step instructions, including:

1. A link to open the Google Workspace admin console's Domain-Wide Delegation page.
2. The Client ID to add as a new API client, with a Copy button.
3. The required OAuth Scopes to grant, with a Copy button.
4. A reminder to save your changes in the Google Workspace admin console, then select Re-check to verify.

User Experience

This section outlines the user-facing features added as part of the post-delivery teachable moments flow.

Category Tags

Based on Defend's analysis, incoming emails from outside your organization have a colored tag applied. The tag's color corresponds to its associated threat level. Tags can be selected to view all emails categorized under that tag.

The following color and category tags may be added to emails:

• Gray: Graymail, Spam
• Blue: First-time sender, Impersonation, Financial, Sensitive, Threat Notification
• Amber: Suspicious
• Red: Dangerous*

*You may never see a Dangerous tag if your admin configured settings to skip the inbox or spam-label dangerous emails.

Threat Notification

If configured by your admin, Defend may send threat-notification emails to help you recognize phishing attempts. These emails arrive after Defend identifies an email as Suspicious or Dangerous and are marked with a blue tag in your inbox.

Threat-notification emails contain the following information and options:

• Original email details
  • Subject
  • From address
  • Sent time
  • Sender location
  • Sender relationship history
• Email Analysis Summary
  • Provides up to five reasons why Defend thought the email could be a phishing attack.
• Report buttons
  • Report the original email as "Phish". This is only available for emails identified as Suspicious.
  • Report the original email as "Not Phish".