This feature is available with G Suite Enterprise, G Suite Enterprise for Education, and Cloud Identity Premium editions.
As a G Suite administrator, the investigation tool enables you to take bulk actions that result in the deletion or modification of large amounts of your organization’s data. For example, you can use the investigation tool to suspend or delete many users. To prevent accidental or malicious use of the tool, super admins in your organization can set up the investigation tool to require reviewers to approve bulk actions.
This option is configured as a global setting for all admins who are using the investigation tool. When the setting is enabled and an admin takes an action on more than 300 items (for example, more than 300 users or email messages), the admin will need to specify a second admin to confirm it.
Turn on the Require reviewer setting
To require reviewers for bulk actions in the investigation tool:
- Sign in to the Google Admin console at admin.google.com with your super admin account.
Be sure to sign in using your super admin account, and not your personal Gmail account.
- Click Security.
- Click Investigation tool.
- From the Investigation page, click the gear icon on the right side of the screen.
The Investigation settings window is displayed.
- Turn on the Require reviewer setting.
- Click APPLY.
Note: For a list of additional settings for the investigation tool, see Configure settings for your investigations.
When the Require reviewer setting is enabled, all admins with access to the investigation tool must choose at least one reviewer before taking action on more than 300 items—for example, more than 300 users or 300 email messages.
Reviewers must have the specific privileges to take action on data that's related to the bulk action—such as Drive, Gmail, or Mobile. If reviewers don't approve the action within 72 hours, the action will expire.
To choose a reviewer for a bulk action:
- Sign in to the Google Admin console at admin.google.com with your admin account.
Be sure to sign in using your admin account, and not your personal Gmail account.
- Click Security.
- Click Investigation tool.
- Run a search (see Customize searches with the investigation tool).
- Select items in the search results (for example, users).
- Click ACTIONS.
- Choose Restore user or Suspend user for users in the selected rows.
- Type the email address of the reviewing admin, and type a message for the reviewing admin.
- Click SEND.
Note: Before the approval is granted, you can cancel the bulk action by clicking CANCEL at the bottom of the Investigation page.
Check the status of your bulk actions
When you take an action, a card is displayed below your current search with the status of your action. For example, the message indicates whether the action is still awaiting approval, or whether the action is completed or has expired.
You can also check the status of your large tasks in the Google Admin console to see if they are still in-progress or completed. For example, if one of your bulk actions in the investigation tool takes a long time to complete, you can leave the Admin console and later return to check the status of your action.
At the top of the Admin console, click Tasks to view the status of your large tasks.
From the tasks window, you can also click View details to see totals about your bulk action: Total attempted, Successes, and Failures. Click See results to see the results in the investigation tool, and for more details about specific items. For example, the results might show that one user wasn't suspended in the bulk action because the account had already been suspended.
For additional details, see also Check the status of large tasks.
Approve bulk actions
You can approve bulk actions if another admin chooses you as a reviewer. You'll receive an email notification with details about the bulk action, and with a request to approve the action.
You must approve the action within 72 hours of receiving the email notification, or the action will expire.
To approve bulk actions:
- In your email notification, click VIEW to sign in to the Google Admin console.
- Enter the username and password for your admin account to verify your identity.
You'll then be directed to the investigation tool in the Google Admin console.
- Click APPROVE (you also have the option to reject the action).
Cancel bulk actions
You have the option to cancel a bulk action before it's approved by a reviewer. At the bottom of the Investigation page, click CANCEL. Canceling actions in the investigation tool results in partial results if the bulk action is already approved by a reviewer and in-progress.