If you are reading this article, you are undoubtedly using the best collaboration and communication platform, i.e., Google Workspace. Well, if you are not using and exploring different features of the platform before making the plunge, you should read further. In this article, we will cover precisely admin capabilities concerning viewing employee emails in an organization. Google workspace provides capabilities to create specific roles and assign administrators privileges over those roles. Those roles allow admins privileges to accomplish specific tasks. In a big organization, it is always necessary to have admins who can help users whenever they have an issue concerning their company accounts. One of the admin privileges is over the “Security Investigations” module. In short, if you want to know whether Google Workspace admins can read emails, the answer is yes.

There are local laws in every country concerning this also that should be looked upon. Ideally, you should never read a user’s email without explicit consent from your legal and compliance team. They should be informed and involved in deciding this. Once you have the go-ahead, it is not a big challenge. Previously, Google didn’t have this capability; at least, it wasn’t available so easily. Let’s discuss the options for admins to see the emails below:

Using Google’s Security Investigation tool:

Google provides a security module in the admin console that lets you configure different IT security policies you need to enforce within the organization. One of the options in the security module is the “Security investigations module.” This is a newly introduced module that helps with investigations and provides admins the capability to look at logs as well as the data in some instances. The audit logs for Gmail, Drive, Chat, Meet, and all Google core services are available in the investigations tool. Google also lets admins take action on those results. To see emails, the admins must enter the criteria matching the emails being looked for. Some examples of such criteria are providing date range, subject, sender, recipient, etc., as details of the email being searched. The results are very narrow with lots of search criteria else it will display all matching ones. Once the results are displayed, you get an option to view the particular email you are looking for. It generally asks the admin for a justification to view the email as its confidential data, and the admins should look into it if needed for an investigation only. Those searches and logs of admin viewing the emails are saved for audit purposes. The admins also get the capability of deleting emails as well. These functionalities are provided as they are a great use to delete malicious emails, emails sent by mistake, etc.

Google investigations tool is only available on certain Google Workspace subscriptions such as Enterprise Plus. If you cannot see the option in the admin console, it could be because of your subscription or because your account doesn’t have the required administrative permissions to use the module.

Get an Email copy of users via the Content compliance rule:

Without knowing the users’ password, it’s also possible for the admin to set up a content compliance rule that can get a copy of the emails in bcc.

You can do the same by following the below steps:

1. Log in to Admin Console (admin.google.com)
2. Go to Apps
3. Click on Gmail under “Apps”
4. Go to advanced settings and click on content compliance.
5. Create a new rule with the criteria as Email messages to affect: Inbound/Outbound as per your requirement, and set up a regex to match the email criteria.
6. Click on “Add more recipients.”
7. Click on replace recipient and enter the recipient’s email address.
8. Add a custom subject. If you do this, it will be easier to identify the emails within the recipient’s mailbox.

These steps can help you audit mailboxes and get a copy of all emails being sent to a mailbox matching certain criteria. The recipient, in this case, does not need to be an admin, but the content compliance rule needs to be set up by an administrator.

Google Vault:

As a super administrator, admins can also access Google Vault service, which allows admins to view emails. Again, the Google Vault service is generally used by legal and compliance teams, and organizations should have proper delegation to services to protect the data.

Technically, Google Vault allows one to create matters, and within matters, it allows one to configure searches. Vault allows searching data from Gmail, Drive, and Chat. Following a similar procedure as in the case of the security investigations tool, you generally need to enter search criteria for the email you are looking for, and Vault shows you some matching results. It is possible to export those results in PST and MBOX formats. Vault also comes in certain Google Workspace subscriptions, but not all.

‍

After knowing the above options, admins can make informed decisions about accessing user emails or seeing them based on needs and requirements from legal aspects. It is always better to define data privacy policies, data leakage prevention, and compliance around these options so that there is a process to adhere to when the need arises.

Cloudasta has been a trusted partner to many organizations using Google Workspace, and we provide constant consultancy and support around these dilemmas and recommend best practices. We are a team of experts that have been using and administering Google Workspace for a long time, and we will be happy to guide you along your journey while you focus solely on your business. If you are interested or have questions regarding our service, feel free to reach out here.

‍