To use Access Management, you need the Google Workspace Assured Controls add-on. For details, speak to your sales representative.
As an administrator, Access Management for Google Workspace enables you to limit the Google staff who can take support actions related to your organization's data based on predefined attributes. Currently, you can select one of the following Access Management policies:
- No preference—Does not limit support personnel
- Access by U.S. Google staff only—U.S. Google staff is defined as U.S. Persons in a physical U.S. location.
- Access by CJIS-authorized and IRS 1075-authorized Google staff only—This limits support actions to only U.S. persons in a U.S. physical location who have completed appropriate background checks. (Ensure your state has completed onboarding with Google Workspace before using this option. Contact your sales representative for more information.)
- Google employees can only access your data when necessary to provide support services and to fulfill contractual and legal obligations.
- Access Management covers only certain core service data. For details, see What data is covered by Access Management?
Requirements for using Access Management
To use the Access Management feature, you need the Google Workspace Assured Controls add-on. To realize the full benefits of Access Management, users assigned to Assured Controls must be on Google Workspace Enterprise Plus, as Access Management events are surfaced in the Access Transparency dashboard.
For administrators managing Google Workspace Enterprise Plus Edition: Individual organizational units can have users at multiple subscription levels. If you use Access Management and set a policy for specific organizational units, that policy will apply only to users within organizational units that have an Assured Controls license.
Set up Access Management
In the Admin console, go to Menu AccountAccount settingsAccess Management.
Requires having the Assured Controls add-on
To set up Access Management for your entire domain, leave the top organizational unit selected. Otherwise, select a child organizational unit or group.
- Choose one of the Access Management policy options.
- Click Save.
Note: Click Override if you're setting up Access Management for a child organizational unit.