Category guide
Google Workspace security features by plan: what each edition includes for identity
In short
Which Google Workspace plans include context-aware access, Secure LDAP, Windows sign-in, and 2-Step Verification. A plan-by-plan table of identity features, built from Google's own pricing page and admin help center.
- Last updated
Primary sources
- Compare Google Workspace plans and pricing · Google
- Protect your business with 2-Step Verification · Google Workspace Admin Help
- Protect your business with Context-Aware Access · Google Workspace Admin Help
- About the Secure LDAP service · Google Workspace Admin Help
- Install Google Credential Provider for Windows · Google Workspace Admin Help
No. Google Workspace Business Plus does not include context-aware access, which Google lists on Enterprise Standard and Plus and on Cloud Identity Premium. Business plans cap at 300 users, and Secure LDAP starts at Business Plus.
Every plan includes 2-Step Verification and some level of endpoint management, and every Business plan lists the Advanced Protection Program. The table below shows what each edition includes for identity, taken from Google's own documentation.
Which Google Workspace plans include which identity features?
Every Google Workspace plan includes 2-Step Verification, but context-aware access, Secure LDAP, and the deeper endpoint management tiers depend on the edition. The table compares the three Business plans and Enterprise, and each cell repeats what Google states on its pricing page or in its admin help center.
| Feature | Business Starter | Business Standard | Business Plus | Enterprise |
|---|---|---|---|---|
| Maximum users | 300 | 300 | 300 | No minimum or maximum |
| 2-Step Verification, including security keys and passkeys | Included | Included | Included | Included |
| Windows sign-in with a Google account (Google Credential Provider for Windows) | Standalone | Standalone | Standalone, or with Windows device management | With Windows device management |
| Secure LDAP for VPNs and LDAP-based apps | Not included | Not included | Included | Included |
| Context-aware access | Not included | Not included | Not included | Enterprise Standard and Enterprise Plus |
| Endpoint management | Fundamental | Fundamental | Advanced | Enterprise |
Google also sells identity-only editions for companies that want Google sign-in without the rest of Workspace. The second table lists only the features this page has confirmed for each one, so it is not a full comparison.
| Edition | What Google lists for it |
|---|---|
| Cloud Identity Free | Windows sign-in through Google Credential Provider for Windows, standalone |
| Cloud Identity Premium | Context-aware access, by user identity, location, device security status, and IP address |
Does Google Workspace Business Plus include context-aware access?
No. Google lists context-aware access on Enterprise Standard and Plus, Frontline Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus, and Cloud Identity Premium, and on no Business plan. Context-aware access sets policy by user identity, location, device security status, and IP address, evaluated continuously for Google's own applications and at sign-in for third-party SAML applications.
So on a Business plan, device-based access policy needs an Enterprise subscription, Cloud Identity Premium, or a separate product. This is easy to misread in Google's packaging: endpoint management appears on every plan, but access policy based on device status does not.
Which 2-Step Verification methods does each plan include?
Every plan supports the same six methods: security keys, the Google prompt, authenticator apps, backup codes, SMS or voice codes, and passkeys. Google calls security keys the most secure form of 2-Step Verification and discourages SMS.
Every Business plan also lists the Advanced Protection Program, Google's strictest account setting for users who face targeted attacks. For phishing resistance, the authentication method a company enforces matters more than the edition it buys, and a company that enforces security keys or passkeys gets phishing-resistant MFA on any edition. How those methods compare with third-party options is in Phishing-resistant MFA for Google Workspace: passkeys vs security keys vs third-party options.
Can Google Workspace sign users in to Windows, VPNs, and other apps?
Yes, through three separate mechanisms with different edition requirements. Google offers single sign-on to over 200 preintegrated cloud apps, plus custom SAML apps for anything outside its catalog. Google Credential Provider for Windows signs users in to Windows with their Google account on every Business plan.
Secure LDAP lets LDAP-based apps and infrastructure, such as VPN servers, authenticate against Google's directory from Business Plus upward. It checks the Google username and password, and users cannot reach Secure LDAP apps by signing in through a third-party identity provider. Coverage for Mac, RDP, and VPN logins is compared in MFA for Windows, Mac, RDP and VPN logins on Google Workspace.
What happens to identity features past 300 users?
Google sells Business Starter, Standard, and Plus for a maximum of 300 users, and Enterprise has no minimum or maximum. Enterprise is priced through Google's sales team rather than at a published list price.
Several identity features change at the user cap. Context-aware access and Enterprise-level endpoint management sit on the Enterprise plans, so a company that crosses 300 users meets both decisions at once. Google's pricing page also runs promotional discounts, so compare list prices, not the promotion.
What companies add when they need more than their plan includes
Companies usually add a dedicated identity provider alongside Google when they need one of three things. The first is device-based access policy on a Business plan, where Google lists context-aware access only on Enterprise and Cloud Identity Premium. The second is MFA on logins outside Google, where Secure LDAP starts at Business Plus and checks the Google password.
The third is one sign-in across cloud apps and on-premises systems. Google's catalog covers over 200 cloud apps plus custom SAML, so what a dedicated provider adds is reach beyond cloud apps. Whether built-in sign-in is already enough is tested in Is Google Workspace 2-Step Verification enough?.
A small team that runs only Google and enforces security keys or passkeys for everyone is often well served by its current plan. A growing company that needs any of the three has a vendor decision to make. Read the full assessment: Best identity providers for growing Google Workspace companies 2026.
How we built this comparison
Every row comes from Google's own pricing page and admin help center, read on 20 October 2026. Nothing is inferred from a feature's absence, and a cell appears only where Google states the answer directly.
Google changes editions and packaging regularly, so this page is re-verified every quarter against the same sources. Prices are left out until they can be read from a US session, because Google's pricing page serves local currency by region.
Frequently asked questions
- Does Google Workspace Business Plus include context-aware access?
- No. Google lists context-aware access on Enterprise Standard and Plus, Frontline Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus, and Cloud Identity Premium, and on no Business plan.
- Which Google Workspace plan includes Secure LDAP?
- Business Plus and Enterprise include Secure LDAP. Business Starter and Business Standard do not.
- Is 2-Step Verification included on every Google Workspace plan?
- Yes. Every plan supports 2-Step Verification, including security keys and passkeys, and Google discourages SMS codes in favor of those stronger methods.
- How many users can a Google Workspace Business plan have?
- Google sells Business Starter, Standard, and Plus for a maximum of 300 users. Enterprise has no minimum or maximum and is priced through Google's sales team.
- Can I sign in to Windows with a Google Workspace account?
- Yes. Google Credential Provider for Windows runs on every Business plan and on Cloud Identity Free, for Windows 10 and 11 Pro, Pro for Workstations, Enterprise, and Education.
- Does every Google Workspace plan include endpoint management?
- Yes. Google describes it as Fundamental on Business Starter and Standard, Advanced on Business Plus, and Enterprise on the Enterprise plans.
- What do companies add when Google Workspace's built-in identity is not enough?
- Most add a dedicated identity provider alongside Google rather than replacing it. The options are ranked in [Best identity providers for growing Google Workspace companies 2026](/best-identity-providers-google-workspace).