Why create a delegated auditor in GAT+? #
By default, only Google Workspace Super Admins have access to the GAT+ tool.
With the delegated auditors functionality Super Admins can assign users to audit or analyze others within their domain without ever having access to the Google Workspace Admin Console (admin.google.com).
How is this useful? Many organizations have multiple offices, departments, campuses, or locations with the delegated auditors feature you can assign the right person to perform the auditing of a group or organizational unit.
Here are a few examples of when delegated auditors could be used:
- A sales manager would like to create reports for his/her sales team covering data across all of the different Google apps like Gmail and Google Drive.
- A school IT Director would like to give another IT member access to GAT+ but not to his/her Google Workspace Admin Console.
- A Super Admin would like to delegate responsibility to his internal auditing team to give them scope over a specific Org unit.
Creating a Delegated Auditor #
In GAT+ navigate to Configuration > Delegaed Auditors > + button (Add new auditor)
View auditor and fill in the details for the Auditor you want to create.
- Product – select the product needed
- GAT+ – create Auditor for GAT+
- Shield – create Auditor for Shield
- Auditor – select the user who will be the Auditor
- User – select individual user to be the Auditor
- Group – select group of users to be the Auditors
- Org. Unit – select org. unit of users to be the Auditors
- Scope – select the users to who the Auditor will audit and have access in GAT or Shield. Users will be under the scope of users the Auditor will manage.
- User – select individual user to be the Auditor
- Group – select group of users to be the Auditors
- Org. Unit – select org. unit of users to be the Auditors
- Include sub. org. units
- Access areas – select what areas in GAT+ and Shield the Auditor will have access to. Access areas visible to the Auditors
- Enable any of the Audit areas
- Enabled – the area will be visible for the Auditor
- Disabled – the area will not be visible for the Auditor
Super Admin #
Super Admin (warning! Can change Permissions and more like GSuite Administrator) – This is special permission and allows the Auditor to have Full Admin privileges, the same as Google Super Admin has using GAT+.
To enable this “Super Admin”, please contact us at support@gatlabs.com
- Valid to – select the time until the Auditor will be enabled.
- Indefinite expiration period
- Active – enable or disable the Auditor
- Click on Save to create the Delegated auditor.
Additional Privileges for Education domains #
When a GAT+ delegated auditor policy is active, you can give the auditor additional privileges. Those privileges allow the Auditor to make changes via Export/Import functionality.
With these additional privileges, the auditor can
- Export any metadata to a Google spreadsheet
- Edit any field in the spreadsheet
- Import the spreadsheet back in to confirm the changes.
Note: A Super Admin has these types of privileges by default.
In Delegated Auditors > click on “lock icon” under Actions to add Additional permissions
Your delegated auditor can now launch and access the tool from their Google Apps button.
In the Google Chrome session click on the Google Apps menu button > scroll down in the menu and click on GAT+
Accessing the tool as a delegated auditor #
When the Auditor logs into GAT+, they will have access only to the selected by Admin audit areas
In the Auditing Areas, they can utilize all of the features of GAT Unlock of course with Security Officer approval.
- They can modify and remove permissions download or view file content.
- They can download emails, view emails, and remove emails from users’ Gmail accounts.
- They can set up email delegation to give one user direct delegation into another user’s Gmail account.
- They can remove and add permissions from Drive
- They can manage Classrooms by adding or removing Students and Teachers from Google Classrooms
- They can delete or archive Google classrooms in bulk
- They can add or remove students Guardians in bulk
Security officer #
If the Auditor is also a Security officer – they will be able to see the Security Officer section in GAT+
- Configuration > Security officer
