Admin privileges for the investigation tool

To use the investigation tool you need to be an administrator with investigation tool privileges. Super administrators have these privileges by default, or you can add them to a custom administrator role.  

Add investigation tool privileges for admins

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Admin roles.

    To see Admin roles, you might have to click More controls at the bottom. 

  3. Under User Created Roles, click a custom administrator role.

    Tip: Click Create a new role if you need to create a custom administrator role.

  4. Click the Privileges tab.
  5. In the Services section, click the Security Center privileges to expand them.
  6. Click to expand the This user has full administrative rights for Security Center privilege.
  7. (Optional) To give the admin access to all Security Center features, including the investigation tool, check the This user has full administrative rights for Security Center box. If not granting full access, continue to Step 8.
  8. To give access only to the investigation tool, check the individual boxes for Investigation Tool privileges. You can add specific privileges for access to different types of data, (Gmail, Drive, Device, and User):
    • View Metadata and Attributes—Run queries and see the results that are returned from the query in the investigation tool. The results could contain sensitive content, such as the subject of an email or title of a document. For example, this privilege allows admins to view headers for Gmail messages.
    • Update or Delete—Update content (such as changing the ACL of a document) or delete an email.
    • View Detailed Content (Beta)—See the content of Gmail messages in the investigation tool. This privilege can help admins understand any risk that might be associated with the message.

For more information about admin privileges, see Admin privileges for the security center.

Was this helpful?
How can we improve it?