Depending on your Google Workspace edition, you might have access to the security investigation tool, which has more advanced features. For example, super admins can identify, triage, and take action on security and privacy issues. Learn more
As your organization's administrator, you can run searches and take action on OAuth log events. For example, you can view a record of actions to review which users are using which third-party mobile or web applications in your domain. For example, when a user opens a Google Workspace Marketplace app, the log records the name of the app and the person using it.
The log also records each time a third-party application is authorized to access Google Account data, such as Google Contacts, Calendar, and Drive files ( Google Workspace only).
Forward log event data to Google Cloud
You can opt in to share log event data with Google Cloud. If you turn on sharing, data is forwarded to Cloud Logging where you can query and view your logs and control how you route and store your logs.
The type of log event data you can share with Google Cloud depends on your Google Workspace, Cloud Identity, or Essentials account.
Run a search for log events
Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.
Audit and investigation tool
To run a search for log events, first choose a data source. Then, choose one or more filters for your search.
-
In the Google Admin console, go to Menu
