Access Approvals: Require Google staff to request approval before viewing support data

To use Access Approvals, you need the Google Workspace Assured Controls add-on. For details, speak to your sales representative.

Access Approvals for Google Workspace requires Google staff to request your organization’s approval before viewing data related to a support action.

Note:

• Google staff can only access your data when necessary to provide support services, to fulfill contractual and legal obligations, and to protect or maintain your systems.
• Access Approvals covers the specific core service data detailed in, "What data is covered by Access Management and Access Approvals?"

Requirements for using Access Approvals

To use Access Approvals, you need the Google Workspace Assured Controls add-on. To realize the full benefits of Access Approvals, users assigned to Assured Controls must be members of an organization using Workspace Enterprise Plus with the Assured Controls add-on. Access Approvals events are surfaced in the Access Transparency logs.

Note: For administrators with Enterprise Plus, individual organizational units can have users at multiple subscription levels. If you use Access Approvals and set a policy for specific organizational units, that policy only applies to users within organizational units that have an Assured Controls license. For more information, go to If you have multiple Google Workspace editions.

Set up Access Approvals

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  AccountAccount settingsAccess Approvals.
3. To set up Access Approvals for your entire domain, leave the top organizational unit selected. Otherwise, select a child organizational unit or a group.
4. Check the Require Google staff to request approval before viewing data necessary for support services option.
5. Click Save if you selected the top organizational unit.
   Click Override if you're setting up Access Approvals for a child organizational unit or a group.

Note:

• The support response time increases while Google Workspace support waits for your approval. We recommend being cautious when enabling Access Approvals if you might require high service availability and rapid response by Google Workspace support.
• For some situations (such as, single-customer outage remediation and legal requests), Google personnel might need to bypass your Access Approvals policy to access customer content in a time-sensitive manner. 

Manage Access Approvals requests

Access Approvals requests are displayed in the alert center.

To manage and filter Access Approvals requests:

1. In your Google Admin console (at admin.google.com), go to Security Alert center.
2. Click Add a filter from the list view in the alert center.
3. Choose the Alert type criteria as the filter from the list.
4. From the alert type window, check the box for Access Approvals request.
5. Click Apply.

For more information, go to Use the alert center.

Approve or decline an access Approvals request

If a pending Access Approvals request is selected, you have the option to approve or decline the request. Each request includes the scope of the data access (for example, Primary data such as Gmail or Drive), the access region (where the data is accessed from), and the access duration.

Admins must have the Manage Access Approvals requests privilege to approve or decline an Access Approvals request. Approving the request grants Google staff access to the data listed in the Scope field. The ability to access your data expires as specified in the Access end date field. 

Note: Declining a request does not prevent any access that was granted through a previously approved Access Approvals request.

Revoke approval

If the access period for an approved Access Approvals request has not expired, admins can  revoke access. View an approved request, choose Available Actions, and “Available action(s)” on the approved request.

Note: Revoking access to an approved request does not prevent any access that was granted through another previously approved Access Approvals request that covers the same scope.

Review responses to Access Approvals requests

You can use the audit and investigation or the security investigation tool to review past responses to Access Approvals requests.

Note: Your access to the security investigation tool depends on your Google Workspace edition, the data source for your search, and your administrative privileges. For more information, see Data sources for the security investigation tool.

To run a search in the security investigation tool:

1. Sign in to the Google Admin console at admin.google.com with your Google Workspace administrator account.
2. On the left, go to Security Security center Investigation tool.
3. Under Data source, select Admin log events.
4. Click Add Condition.
5. Under Attribute, select Event. 
6. Under Event, enter a text search for Access Approvals, and select Access Approvals admin action.
7. Click Search.
8. Review the search results in the table at the bottom of the page.
   The Description column displays past responses to Access Approvals requests in your organization—whether or not they were approved or declined.

For more details about using the security investigation tool to review past Admin log events, go to Admin log events: Security investigation tool.

To run a search on the audit and investigation page:

1. Sign in to the Google Admin console at admin.google.com with your Google Workspace administrator account.
2. On the left, go to Reporting Audit and investigation Admin log events.
3. Click Add a filter  (), and then select Event.
4. Under Event, enter a text search for Access Approvals, and select Access Approvals admin action.
5. Click Apply.
6. Click Search.
7. Review the search results in the table at the bottom of the page.
   The Description column displays the status of the Access Approvals requests in your organization—whether or not they were approved or declined.

For more details about using the audit and investigation page to review past Admin log events, go to Admin log events: Audit and investigation page.

Manage Access Approvals emails

Admins can be alerted to new pending Access Approvals requests via email. You can configure the email notification in the Access Approvals request rule.

Related topics

• What data is covered by Access Management and Access Approvals?
• Assured Support for Access Management
• Access Transparency: View logs on Google access to user content
• Choose a geographic location for your data