Google Workspace SAML IDP Configuration Change

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•1•0•1,118

This rule identifies changes to SAML (Security Assertion Markup Language) provider configurations within Google Workspace. Monitoring these changes is crucial for security teams as modifications to SAML configurations can potentially weaken an organization's security posture, leading to unauthorized access or other security incidents. The rule specifically looks for events categorized as 'SAML2_SERVICE_PROVIDER_CONFIG_SETTINGS' or with product event types matching 'SAML2_SERVICE_PROVIDER_CONFIG'.