Multi-tenancy management for GAT+ Admins

GAT+ empowers admins to seamlessly manage multiple domains from a single admin account. This multi-tenancy management feature streamlines administration by allowing a single admin to oversee various externally owned and entirely separate domains effortlessly.

What does it do? #

• Centralized Control:
  • A single ‘Manager’ admin account serves as the central hub for managing multiple domains.
  • Simplified navigation and oversight for efficient administration.
• Manager Account Access:
  • Admins and Delegated Auditors of individual domains grant access to a ‘Manager’ account for GAT+ control of their domain by another external admin
  • Collaborate seamlessly with external admins without compromising security.
  • The Manager account has the same level of access in GAT+, as the user that granted them access
  • The Manager will also get a new dashboard to show alerts in across all the domains they have access as a single pane of glass
• Impersonation Feature:
  • Managers cannot access a domain unless permission is granted intentionally by the external admin account on the puppet domain
  • Ensures secure and controlled access to domain-specific functionalities.
  • Limit the Manager’s control on your domain by granting them access to a Delegated Auditor account, rather than a super admin account, if desired

This streamlined Multi-Tenancy Management feature in GAT+ enhances efficiency, security, and collaboration for admins overseeing diverse domains.

Experience the ease of unified administration with GAT+.

How do I set it up? #

To enable this feature:

• Both domains must have an active GAT+ subscription, that includes GAT Unlock
• The local admin of the puppet domain must allow the host admin (an external admin) to impersonate them via GAT+.
• The Security Officer of the puppet domain, must grant the impersonation request.

What Changes? #

• Manager Control:
  • Full GAT+ (all other products) control as if you were the Admin of the local domain.
• User Notification:
  • Clear message: “You are impersonating another user” reinforces awareness to the Manager during the session.

Experience effortless impersonation for comprehensive GAT+ control in Multi-Tenancy Management!

Enable Multi-Tenancy Management impersonation in GAT+ step by step #

To enable a domain impersonation – the local Admin must give access to the Manager account.

1. Navigate to GAT+ > “your_account_name” > Settings > Impersonation.
2. Enter the Manager (external admin) account email address in the Allow My Account to be Impersonated by field.
3. Click on “Send request” – to send a request email for approval.

Unlock required #

When you click ‘Save’ – the Security officer will receive an email to approve the action.

This will lead to the Approval page, where one of the Security Officers can approve the request.

Click the ‘checkmark’ icon to approve the request.

Result: #

Once approved, the Multi-tenancy management will be enabled and the Manager account will be able to control your Google Workspace domain via GAT+

Once added, the designated Manager account gains access to the impersonating account and all the associated privileges that this account has in with all the GAT Labs products

Managed accounts that the Manager has control of are visible under their account.

They will be allowed to choose which account they would like to audit and investigate on.

Below are examples of the end-result view for each of the products.

GAT+  #

View of GAT+

 

GAT Shield #

View of GAT Shield

GAT Flow #

View of GAT Flow

Teacher Assist #

View of Teacher Assist

This feature provides comprehensive control over external accounts, encompassing all available products for the Mangers (host) domain:

• Complete Control:
  • Seamless management of all products within the host domain.
  • Full control over puppet accounts, covering GAT+, Flow, Shield, and Teacher Assist.
• BETA Version Note:
  • Please note that the current version is in BETA.
  • Some actions may be restricted:
    • Scheduled reports will be set by default to work if the local admin created them (additional recipients can be added via advanced mode))
    • Export into Google Spreadsheet will show an error message, please use CSV export instead.
• Admin Log Transparency:
  • The Admin Log functions normally, creating an immutable record of all actions done by the Super Admins.
  • Actions, whether on GAT+, Flow, Shield, or Teacher Assist, are meticulously logged for accountability.

This structured approach ensures that while having full control, users are informed about the BETA limitations and benefit from a transparent Admin Log for comprehensive oversight.

Region restrictions #

This feature works only if the domains are in the same server in the Google Cloud Platform

• gs.generalaudittool.com at the beginning of the GAT+ application URL means data is in USA servers
• uk.generalaudittool.com at the beginning of the GAT+ application URL means data is on UK servers
• eu.generalaudittool.com at the beginning of the GAT+ application URL means data is in EU servers

If you find that the data is on two different servers, please contact the GAT+ team (support@generalaudittool.com)

Explore the power of Full Control in GAT+ Multi-Tenancy Management!