Unlock is a feature within GAT+ that allows Google Workspace admins to take different actions across their domain.
The Unlock functionality is required for:
- Viewing content of Files and Emails
- Changing ownership of Google Drive Files
- Copying Google Drive folders and moving them to another user
- Adding or removing users from Drive and Shared Drive files
- Setting up email delegation to user accounts
- Using the GAT Flow functionality to:
-
- Onboard users into the domain
- Offboard users from the domain
- Modify users in the domain
-
The Unlock functionality requires each of the actions above to be approved by the Security Officer. This is designed as a security feature.
NOTE: To have access to GAT Flow you must have GAT Unlock configured, this product requires a paid subscription.
What is pre-approved access in GAT Flow? #
Preapproval in Unlock allows the action chosen for Flow, Drive, or Email to be done without the need of the Security Officer’s approval for every request.
i.e.: Allowing Unlock to be used without approval by the Security officer.
The Pre-approval configuration must be set up or approved by Security Officer.
How to set up GAT Flow pre-approval in GAT+? #
Navigate to GAT+ > Configuration > Security Officer > Access permissions
In Access Permissions click on the + button <- Click here to create new preapproved access
A new window will be displayed fill in the details required:
- Authorized user – select the user who you want to set pre-approved access to
- Type – Flow, Drive, Email
- Scope – User, Group, Org.Unit
- Valid until – set the time until pre-approved access will be granted
- Flow types – select the type of workflow
- Onboarding
- Offboarding
- Modify
Click on Save and the configuration will be added to the Access permissions table (see below).
IMPORTANT: If an Administrator who also serves as a Security Officer creates pre-approved access for themselves, it cannot be automatically approved for security reasons. It requires second Security Officer to review the request and approve it.
If second Security Officer creates such access for the Administrator, it will be automatically approved because they, as the second party, authorized the access.
Flow Pre-Approval Setup #
Navigate to Flow > Configuration > Preapproved access > + New Preapproved Access
A new window will be displayed fill in the details required:
- User – select the user who you want to set pre-approved access to
- Scope type – User, Group, Org.Unit
- Scope – enter the user/group/org.unit
- Valid to – set the time until pre-approved access will be granted
- Flow types – select the type of workflow
- Onboarding
- Offboarding
- Modify
Click on Save and the configuration will be added to the Access permissions table (see below).
Result #
The Pre-approved access will be granted to the selected user automatically if created by Security Officer. Status =Approved.
If the Pre-approved is created by Super Admin who also serves as Security Officer, it must be approved by the second Security Officer for security reasons. Status = Pending until approved by Security Officer.
Pending Request Approval in GAT Flow #
Security Officer can approve Pending requests in GAT Flow by clicking on the Details icon.
The new window with option to Deny or Approve will be displayed.
Pending Request Approval in GAT+ #
Alternatively, Security Officer can approve Pending requests in GAT+ by clicking on the More actions icon. The options to Approve or Deny will be displayed.
Confirm the approval.
Pre-approval in Create Workflow Results #
When pre-approval in Flow is enabled, the Admin will receive pop-up notifications every time they are about to send the request.
The pop-up will show them that pre-approval is enabled and security officer is not required
When the Admin “Create workflow”, they will receive a pop-up message as below.
Pre-approval in Event and Recurring Workflows #
When Event or Recurring workflow is used:
- The Event and Recurring workflow needs to be approved separately from the Pre-approval
- The “Pre-Approval” option must be selected when configuring the workflow (see below)
Edit & Delete Pre-approval setup #
Edit in GAT Flow #
To edit existing pre-approved access, navigate to Flow > Preapproved access
- Click on the “pen” icon to edit existing preapproved access.
- Click on the “bin/trash” icon to delete the preapproved access.
Edit in GAT+ #
To edit existing pre-approved access, navigate to GAT+ > Configuration > Security Officer > Access permissions
Find the Preapproved access > click on the “eye” icon and edit the Flow types > click on Save (“check mark”) button > “Changes saved!” message will appear on the top right corner of the dashboard. You can now Close the configuration window.
Video of setting up pre-approval in Flow
