GAT+ Delegated Auditors for Education

Why create a delegated auditor in GAT+? #

By default, only Google Workspace Super Admins have access to the GAT+ tool.

With the delegated auditors functionality Super Admins can assign users to audit or analyze others within their domain without ever having access to the Google Workspace Admin Console (

How is this useful? Many organizations have multiple offices, departments, campuses, or locations with the delegated auditors feature you can assign the right person to perform the auditing of a group or organizational unit.

Here are a few examples of when delegated auditors could be used:

  • A sales manager would like to create reports for his/her sales team covering data across all of the different Google apps like Gmail and Google Drive.
  • A school IT Director would like to give another IT member access to GAT+ but not to his/her Google Workspace Admin Console.
  • A Super Admin would like to delegate responsibility to his internal auditing team to give them scope over a specific Org unit.

Creating a Delegated Auditor #

In GAT+ navigate to Configuration > Delegaed Auditors > + button (Add new auditor)

View auditor and fill in the details for the Auditor you want to create.

  • Product – select the product needed
    • GAT+ – create Auditor for GAT+
    • Shield  – create Auditor for Shield
  • Auditor – select the user who will be the Auditor
    • User – select individual user to be the Auditor
    • Group – select group of users to be the Auditors
    • Org. Unit – select org. unit of users to be the Auditors
  • Scope – select the users to who the Auditor will audit and have access in GAT or Shield. Users will be under the scope of users the Auditor will manage.
    • User – select individual user to be the Auditor
    • Group – select group of users to be the Auditors
    • Org. Unit – select org. unit of users to be the Auditors
      • Include sub. org. units

  • Access areas – select what areas in GAT+ and Shield the Auditor will have access to. Access areas visible to the Auditors

  • Enable any of the Audit areas
    • Enabled – the area will be visible for the Auditor
    • Disabled – the area will not be visible for the Auditor

Super Admin #

Super Admin (warning! Can change Permissions and more like GSuite Administrator) – This is special permission and allows the Auditor to have Full Admin privileges, the same as Google Super Admin has using GAT+.

To enable this “Super Admin”, please contact us at
  • Valid to – select the time until the Auditor will be enabled.
    • Indefinite expiration period
  • Active – enable or disable the Auditor

  • Click on Save to create the Delegated auditor.

Additional Privileges for Education domains #

When a GAT+ delegated auditor policy is active, you can give the auditor additional privileges. Those privileges allow the Auditor to make changes via Export/Import functionality.

With these additional privileges, the auditor can

  • Export any metadata to a Google spreadsheet
  • Edit any field in the spreadsheet
  • Import the spreadsheet back in to confirm the changes.
Note: A Super Admin has these types of privileges by default.

In Delegated Auditors > click on “lock icon” under Actions to add Additional permissions

Permissions for Education domains #

Manage additional permissions – in the following areas:

  • Classroom import
  • Group import
  • User import
  • Automatic email forwarding
  • Email delegation
  • Students imports
  • ChromeOS devices import

The Admin can create Delegated auditors in the education domain, and allow the Auditors to fully audit and manage Google classrooms.

  • Classroom import allows:
  • Import/export Students from the domain
  • Add and delete Google classrooms 
  • Add and delete Teachers and Students from Google classrooms
  • Add or delete student Guardians

Add the aditional permissions and click on the Save button

Access GAT+ as Delegated auditor #

Your delegated auditor can now launch and access the tool from their Google Apps button.

In the Google Chrome session click on the Google Apps menu button > scroll down in the menu and click on GAT+

Accessing the tool as a delegated auditor #

When the Auditor logs into GAT+, they will have access only to the selected by Admin audit areas

Navigating within GAT+

In the Auditing Areas, they can utilize all of the features of GAT Unlock of course with Security Officer approval.

  • They can modify and remove permissions download or view file content.
  • They can download emails, view emails, and remove emails from users’ Gmail accounts.
  • They can set up email delegation to give one user direct delegation into another user’s Gmail account.
  • They can remove and add permissions from Drive
  • They can manage Classrooms by adding or removing Students and Teachers from Google Classrooms
  • They can delete or archive Google classrooms in bulk
  • They can add or remove students Guardians in bulk

Security officer #

If the Auditor is also a Security officer – they will be able to see the Security Officer section in GAT+

  • Configuration > Security officer

This website uses cookies to ensure you get the best experience on our website