Yes! With advanced protection you get enforced security keys, recovery only through admins, enforced safe browsing in Chrome. It's a nice way to get a bunch of improved controls in one shot.

Would be nice if Google allowed enforcing it with a grace period for new accounts though!

Agreed - there's basically nothing in GSuite about it, except the indicator on a user's page. It's enough for manual auditing at least. But since we handle it during our onboarding and we're small enough for a manual audit it works out alright.

One hundred percent agreed. Not sure why Google doesn't allow enforcement of this for Workspace accounts.

This is a great guide, I just wish Google made it easier to be "secure by default". It's very difficult to know all the various toggles you need to have switched on to be secure.

I enjoy the enhanced security that advanced protection program offers but miss being able to use gmail in exchange mode specifically because it allows receiving push notifications for new emails without having to trust gmail’s iOS app which always spooks me as being an extra tracking app on my phone