Access Management: Limit the Google staff who can take support actions related to your data

To use Access Management, you need the Google Workspace Assured Controls add-on. For details, speak to your sales representative.

As an administrator, Access Management for Google Workspace enables you to limit the Google staff who can take support actions related to your organization's data based on predefined attributes. Currently, you can select one of the following Access Management policies:

• No preference—Does not limit support personnel
• Access by U.S. Google staff only—U.S. Google staff is defined as U.S. Persons in a physical U.S. location.
• Access by CJIS-authorized and IRS 1075-authorized Google staff only—This limits support actions to only U.S. persons in a U.S. physical location who have completed appropriate background checks. (Ensure your state has completed onboarding with Google Workspace before using this option. Contact your sales representative for more information.)

Note:

• Google employees can only access your data when necessary to provide support services and to fulfill contractual and legal obligations.
• Access Management covers only certain core service data. For details, see What data is covered by Access Management?

Requirements for using Access Management

To use the Access Management feature, you need the Google Workspace Assured Controls add-on. To realize the full benefits of Access Management, users assigned to Assured Controls must be on Google Workspace Enterprise Plus, as Access Management events are surfaced in the Access Transparency dashboard.

For administrators managing Google Workspace Enterprise Plus Edition: Individual organizational units can have users at multiple subscription levels. If you use Access Management and set a policy for specific organizational units, that policy will apply only to users within organizational units that have an Assured Controls license.

Set up Access Management

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAccount settingsAccess Management.

   Requires having the Assured Controls add-on
3. To set up Access Management for your entire domain, leave the top organizational unit selected. Otherwise, select a child organizational unit or group.
4. Choose one of the Access Management policy options.
5. Click Save.
   
   Note: Click Override if you're setting up Access Management for a child organizational unit.

Related topics

• What data is covered by Access Management?
• Assured Support for Access Management
• Access Transparency: View logs on Google access to user content
• Choose a geographic location for your data