Require reviewers for bulk actions

This feature is available with Cloud Identity Premium edition. Compare editions 

As an administrator, you can use the investigation tool to take bulk actions that result in the deletion or modification of large amounts of your organization’s data. For example, you can use the investigation tool to suspend or delete many users. To prevent accidental or malicious use of the tool, super admins in your organization can set up the investigation tool to require reviewers to approve bulk actions.

This option is configured as a global setting for all admins who are using the investigation tool. When the setting is enabled and an admin takes an action on more than 300 items (for example, more than 300 users or email messages), the admin will need to specify a second admin to confirm it.

Turn on the Require reviewer setting

You must be signed in as a super administrator for this task.

To require reviewers for bulk actions in the investigation tool:

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecuritySecurity centerInvestigation tool.
3. From the Investigation page, click the gear icon on the right side of the screen.
4. The Investigation settings window is displayed.
5. Turn on the Require reviewer setting.
   To see this setting, you must be signed in as a super administrator.
6. Click APPLY.

Note: For a list of additional settings for the investigation tool, see Configure settings for your investigations.

Choose reviewers

When the Require reviewer setting is enabled, all admins with access to the investigation tool must choose at least one reviewer before taking action on more than 300 items—for example, more than 300 users or 300 email messages.

Reviewers must have the specific privileges to take action on data that's related to the bulk action—such as Drive, Gmail, or Mobile. If reviewers don't approve the action within 72 hours, the action will expire.

To choose a reviewer for a bulk action:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecuritySecurity centerInvestigation tool.
3. Run a search (see Customize searches with the investigation tool).
4. Select items in the search results (for example, users).
5. Click ACTIONS.
6. Choose Restore user or Suspend user for users in the selected rows.
7. Type the email address of the reviewing admin, and type a message for the reviewing admin.
8. Click SEND.

Note: Before the approval is granted, you can cancel the bulk action by clicking CANCEL at the bottom of the Investigation page.

Check the status of your bulk actions

When you take an action, a card is displayed below your current search with the status of your action. For example, the message indicates whether the action is still awaiting approval, or whether the action is completed or has expired.

You can also check the status of your large tasks in the Google Admin console to see if they are still in-progress or completed. For example, if one of your bulk actions in the investigation tool takes a long time to complete, you can leave the Admin console and later return to check the status of your action. 

At the top of the Admin console, click Tasks  to view the status of your large tasks.

 

From the tasks window, you can also click View details to see totals about your bulk action: Total attempted, Successes, and Failures. Click See results to see the results in the investigation tool, and for more details about specific items. For example, the results might show that one user wasn't suspended in the bulk action because the account had already been suspended.

For additional details, see also Check the status of large tasks.

Approve bulk actions

You can approve bulk actions if another admin chooses you as a reviewer. You'll receive an email notification with details about the bulk action, and with a request to approve the action.

You must approve the action within 72 hours of receiving the email notification, or the action will expire.

To approve bulk actions:

1. In your email notification, click VIEW to sign in to the Google Admin console.
2. Enter the username and password for your admin account to verify your identity.
   You'll then be directed to the investigation tool in the Google Admin console.
3. Click APPROVE (you also have the option to reject the action).

Cancel bulk actions

You have the option to cancel a bulk action before it's approved by a reviewer. At the bottom of the Investigation page, click CANCEL. Canceling actions in the investigation tool results in partial results if the bulk action is already approved by a reviewer and in-progress.