Using the GAT Unlock functionality within the GAT+ tool you can review email content, delete, or in emails.
Searching for Emails in Real-time (Doesn’t depend on Email metadata scan) #
Email Content Search tab #
The Email Content Search tab is a real-time search for email metadata, a Workspace Super Admin or a Delegated Auditor provides the search operators which will then be passed via the Google API to search across all users’ Gmail accounts.
There are multiple reasons to have the ability to identify and remove emails that have been received by all or any of your domain users. Here are some unwanted scenarios:
- An email is sent to the wrong user or group
- An email contains inappropriate content
- An email that contains sensitive information
- An email that has gone past spam filtering or is a phishing email.
The Unlock feature allows Super Admins or Delegated Auditors to delete these emails from all accounts at once.
We recommend using the ‘Email Content Search’ tab for tracking down these emails.
Real-time search #
This is a ‘real-time’ search that is highly configurable (see the ‘search tips’ link beside the search box). In the screenshot above we use the example search operators.
In the query field enter for example:
- “SEO proposal” in:anywhere newer_than:90d
When a search is done, if the result cannot be displayed promptly, the search goes into “Previous searches / Unlock”.
You can access those searches by selecting ‘Previous searches / Unlock‘.
All older or background searches will be displayed there.
Once completed, under the ‘Actions’ tab select the green checkmark to display the results.
When the results are displayed, select the emails you wish to view/download/delete then click the “Email operations” button and select “Create new access request”. This action will require the approval of your designated Security Officer (SO).
Requesting Access from the Security Officer #
- Select the emails you want
- Select Email operations
- Select Create New Access Request
A new window will be displayed, fill in the details
- Request access until – select how long the access to the emails is needed
- Message (optional) – leave a message to the Security Officer
- Additional permissions – enable the “allow removing emails”, enable if you want to delete the emails from the end-users inbox.
- Send request – click to send the request for approval
Before sending the request if you intend to remove the emails rather than just view or download them then check the ‘Allow removing emails’ box.
The Security Officer will have to approve the requests for you to be able to take the below actions.
Procedure for the Security Officer #
All Security Officers will get an email to confirm a request is pending approval.
If the Security Officer receives an email: GAT+ Access permission, new request clicks on the link in the email, they will be redirected to the GAT+ tool.
Within the Access Permissions tab, they will see requests pending for actions on emails.
Note: You can not self-approve the request, only another Security officer account can approve requests.
Note: While you wait for approval from the Security officer, you might use the tool for other searches.
Result after the request is approved #
When you come back to the Email Content Search tab simply select “Previous searches / Unlock”. New window will be displayed, you will see your searches.
When the Unlock feature is approved, you will see under Status: Active Unlock Request
Select the result by clicking on the “green checkmark” under Actions (3).
The result of the filter and unlock feature enabled will be displayed.
You can view the email content as well as delete the emails 1 by 1 or in bulk.
Restore deleted emails #
If emails are deleted permanently and done by mistake they can be resoted via the Admin console for 25 days from the day of deletion.
The process is explained in this Google article
