Access Approvals: Require Google staff to request approval before viewing support data

To use Access Approvals, you need the Google Workspace Assured Controls add-on. For details, speak to your sales representative.

As an administrator, Access Approvals for Google Workspace requires Google staff who can take support actions related to your organization's data to request approval before viewing data necessary for support.

Note:

Requirements for using Access Approvals

To use Access Approvals, you need the Google Workspace Assured Controls add-on. To realize the full benefits of Access Approvals, users assigned to Assured Controls must be on Google Workspace Enterprise Plus, as Access Approvals events are surfaced in the Access Transparency logs.

Note: For administrators with Enterprise Plus, individual organizational units can have users at multiple subscription levels. If you use Access Approvals and set a policy for specific organizational units, that policy only applies to users within organizational units that have an Assured Controls license. For more information, go to If you have multiple Google Workspace editions.

Set up Access Approvals

  1. Sign in to your Google Admin console at admin.google.com.
    Be sure to sign in using your administrator account, and not your personal Gmail account.
  2. In the Admin console, go to Menu "" Accountand thenAccount settingsand thenAccess Approvals.
    Requires having the Assured Controls add-on and the super-admin privilege.
  3. To set up Access Approvals for your entire domain, leave the top organizational unit selected. Otherwise, select a child organizational unit or group.
  4. Check the following box: Require Google staff to request approval before viewing data necessary for support services
  5. Click Save.
    Click Override if you're setting up Access Approvals for a child organizational unit.

Note:

  • The support response time increases by the duration that Google Workspace support spends waiting for your approval. We recommend being cautious when enabling Access Approvals where you might require high service availability and rapid response by Google Workspace support.
  • For some situations (such as, single-customer outage remediation and legal requests), Google personnel might need to bypass your Access Approvals policy to access customer content in a time-sensitive manner. 

Manage Access Approvals requests

Access Approvals requests are displayed in the alert center.

To manage and filter Access Approvals requests:

  1. In your Google Admin console (at admin.google.com), go to Security and then Alert center.
  2. Click Add a filter from the list view in the alert center.
  3. Choose the Alert type criteria as the filter from the list.
  4. From the alert type window, check the box for Access Approvals request.
  5. Click Apply.

For more information, go to Use the alert center.

If a pending Access Approvals request is selected, you have the option to approve or decline the request. Each request includes the scope of the data access, the access region (where the data is accessed from), and the access duration.

Admins must have the Manage Access Approvals requests privilege to approve or decline an Access Approvals request. Approving the request grants Google staff access to the data listed in the Scope field. The ability to access your data expires as specified in the Access end date field. 

Note: Declining a request does not prevent any access that was granted through a previously approved Access Approvals request.

Review responses to Access Approvals requests

You can use the audit and investigation page or the security investigation tool to review past responses to Access Approvals requests.

Note: Your access to the security investigation tool depends on your Google Workspace edition, the data source for your search, and your administrative privileges. For more information, see Data sources for the security investigation tool.

To run a search in the security investigation tool:

  1. Sign in to the Google Admin console at admin.google.com with your Google Workspace administrator account.
  2. On the left, go to Security and then Security center and then Investigation tool.
  3. Under Data source, select Admin log events.
  4. Click Add Condition.
  5. Under Attribute, select Event
  6. Under Event, enter a text search for Access Approvals, and select Access Approvals admin action.
  7. Click Search.
  8. Review the search results in the table at the bottom of the page.
    The Description column displays past responses to Access Approvals requests in your organization—whether or not they were approved or declined.

For more details about using the security investigation tool to review past Admin log events, go to Admin log events: Security investigation tool.

To run a search on the audit and investigation page

  1. Sign in to the Google Admin console at admin.google.com with your Google Workspace administrator account.
  2. On the left, go to Reporting and then Audit and investigation and then Admin log events.
  3. Click Add a filter, and then select Event.
  4. Under Event, enter a text search for Access Approvals, and select Access Approvals admin action.
  5. Click Apply.
  6. Click Search.
  7. Review the search results in the table at the bottom of the page.
    The Description column displays the statuses of the Access Approvals requests in your organization—whether or not they were approved or declined.

For more details about using the audit and investigation page to review past Admin log events, go to Admin log events: Audit and investigation page.

Manage Access Approvals emails

Admins can be alerted to new pending Access Approvals requests via email. You can configure the email rule here.

Related topics

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Search
Clear search
Close search
Google apps
Main menu
Search Help Center
false
false
true
73010
false
false