To use Access Management, you need the Google Workspace Assured Controls Plus add-on. For details, speak to your sales representative.
*Customers who purchased Assured Controls and the Assured Support add-on prior to June 17 2024 will still have access to Access Management
As an administrator, Access Management for Google Workspace enables you to limit the Google staff who can take support actions related to your organization's data based on predefined attributes. Currently, you can select one of the following Access Management policies:
- No preference—Does not limit support personnel
- Access by U.S. Google staff only—U.S. Google staff is defined as U.S. Persons in a physical U.S. location.
- Access by CJIS-authorized and IRS 1075-authorized Google staff only—This limits support actions to only U.S. persons in a U.S. physical location who have completed appropriate background checks. (Ensure your state has completed onboarding with Google Workspace before using this option. Contact your sales representative for more information.)
- Access by EU Google staff or via EU virtual desktop—This limits support actions to EU staff in EU locations. If necessary, non-EU Google staff may access data through virtual desktops that are located in EU locations.
Note:
- Google employees can only access your data when necessary to provide support services and to fulfill contractual and legal obligations.
- Access Management covers only certain core service data. For details, see What data is covered by Access Management?
Requirements for using Access Management
To use the Access Management feature, you need the Google Workspace Assured Controls add-on. To realize the full benefits of Access Management, users assigned to Assured Controls must be on Google Workspace Enterprise Plus, as Access Management events are surfaced in the Access Transparency dashboard.
For administrators managing Google Workspace Enterprise Plus Edition: Individual organizational units can have users at multiple subscription levels. If you use Access Management and set a policy for specific organizational units, that policy will apply only to users within organizational units that have an Assured Controls license.
Set up Access Management
-
Sign in to your Google Admin console.
Sign in using an account with super administrator privileges (does not end in @gmail.com).
-
In the Admin console, go to Menu
Data
Compliance
Requires having the Assured Controls Plus add-on
-
To set up Access Management for your entire domain, leave the top organizational unit selected. Otherwise, select a child organizational unit or group.
- Choose one of the Access Management policy options.
- Click Save.
Note: Click Override if you're setting up Access Management for a child organizational unit.
