Back to Checks
googleworkspace

Less secure app access is disabled

security_less_secure_apps_disabled
Service: securitySeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

The domain-level policy disables access to less secure apps that do not use modern security standards such as OAuth. Blocking these apps helps keep user accounts and organizational data safe.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

When less secure app access is enabled, users can allow apps that use basic authentication (username and password only) to access their Google account. These apps are more vulnerable to credential theft and do not support 2-Step Verification, increasing the risk of account compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks security_less_secure_apps_disabled

Recommendation

Disable less secure app access to prevent users from allowing apps that do not use modern authentication standards to access their accounts.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Security** > **Access and Data Control** > **Less secure apps**
3Select **Disable access to less secure apps (Recommended)**
4Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.security.security_client import (
    security_client,
)


class security_less_secure_apps_disabled(Check):
    """Check that less secure app access is disabled.

    This check verifies that the domain-level policy prevents users from
    allowing access to apps that use less secure sign-in technology,
    reducing the risk of credential compromise.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if security_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=security_client.policies,
                resource_id="securityPolicies",
                resource_name="Security Policies",
                customer_id=security_client.provider.identity.customer_id,
            )

            less_secure_allowed = security_client.policies.less_secure_apps_allowed

            if less_secure_allowed is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Less secure app access is disabled "
                    f"in domain {security_client.provider.identity.domain}."
                )
            elif less_secure_allowed is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Less secure app access uses Google's secure default "
                    f"configuration (disabled) "
                    f"in domain {security_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Less secure app access is enabled "
                    f"in domain {security_client.provider.identity.domain}. "
                    f"Less secure app access should be disabled to prevent "
                    f"credential compromise through apps that do not use modern "
                    f"security standards."
                )

            findings.append(report)

        return findings

References