Blocking few generic passwords for Gmail sign for users

[VickyJ]

Hello Team, 

As an admin we want to have our users to set the passwords that spammers should not guess and hence we wanted to restrict our users not to use few passwords for their email accounts.

Currently there is no options for admins to perform these actions. It would be helpful if Google develops this for the admins.

[jayhlee]

Hi VickyJ,

  Google already prevents users from setting generic pasword like "password" or "123456". You can additionally require users to set a strong password with high entropy:

https://support.google.com/a/answer/139399?hl=en#zippy=%2Cwhat-makes-a-password-strong

[VickyJ]

Hey Team,

Currently Google only blocks weak passwords, like "123456" or "password123".

Considering the same for a domain example.com, there are high chances users
may use passwords like "example123" or "Example123 '' etc which we (as
admins) currently don't have access to restrict.

--
Thanks and Regards:
Vicky J
Webveer Automation and Services

[jayhlee]

Hi Vicky,

  Understood. I believe Google does block some permutations of the user email address and name but have not tested this in some time. Beyond this if you'd like stricter control of user passwords you can configure the SAML SSO change password URL to point to a web service where users can set their password. The service would be responsible for confirming the password meets your organization requirements and then pushing the password to Google using the Directory API.

Additionally I'll add that while strong passwords are helpful in protecting users, even the strongest passwords can be stolen via phishing or key logging. I would encourage you to look at encourage / enforcing two-step verification among your users in order to reduce succesful attacks on your users.

https://support.google.com/a/answer/9176657?hl=en

Jay

[Sapherywa]

Your concern about restricting users from using generic passwords for Gmail accounts is valid for enhancing security. While Google doesn't currently offer this feature for admins, there are proactive steps users can take.
Encouraging users to use a strong (URL Removed by Staff) can help create complex and unique passwords that are harder for spammers to guess.
Additionally, educating users about the importance of password security and recommending best practices, such as avoiding easily guessable passwords and regularly updating passwords, can further enhance account security.