Overview
Google Workspace can alert administrators when a user's credentials appear in a known data breach, and Chrome can warn users when they reuse corporate passwords on unauthorized sites. Configuring both layers of protection ensures your organization is notified quickly when credentials may be compromised.
Prerequisites
Super Admin access to the Google Admin console
Chrome Enterprise for password reuse protection
Instructions
Enable leaked password alerts
Sign in to the Google Admin console
Navigate to Security > Alert center
Click Manage alerts and email notifications
Locate the Leaked password rule and click on it
In the Actions panel, ensure Alerts are turned On
Add recipients under Email notifications, such as super administrators or a dedicated security group
Click Save
Enable password reuse protection in Chrome
Navigate to Devices > Chrome > Settings > Users & browsers
Select the organizational unit you want to apply this setting to
Search for Password alert and click on it
Under Configuration, select the appropriate option for your organization's requirements:
Standard — Select Trigger on password reuse on phishing page. Chrome warns users only when they reuse their corporate password on a site that Safe Browsing has identified as a phishing site.
Strict — Select Trigger on password reuse. Chrome warns users any time they reuse their corporate password on a site that hasn't been explicitly authorized, regardless of whether it's been identified as a phishing site.
Once selected, click Save.
Note: Optionally, you can enter a URL for password change to direct users to your organization's password reset page when a warning is triggered, and add Login URLs to define which sites Chrome should capture password fingerprints from.