Skip to content

Running account access reviews

How a company starts a review of its Google Workspace accounts, how the assigned reviewer retains, removes or excepts each account, and how exceptions are reviewed and the review closed.

Updated

An account access review asks one named person to look at every account in your company directory and decide whether each should stay. It covers account status only. Google groups, app permissions and sessions are not part of it.

Who can do this

  • An owner or editor starts, closes and cancels reviews.
  • The assigned reviewer, whatever their role, decides each account. Only they can.
  • A time-bound exception is reviewed by a different company manager from the person who proposed it.

Before you start

Connect your Google Workspace directory under People & access, and make sure it has been read successfully in the last 48 hours.

Find it

Open People & access in the sidebar, under Programmes, then Account reviews. If you are a reviewer, the review is also in My work, under Your account access reviews.

Start a review

  1. Press Start account review. The form has steps. Press Continue to move on.
  2. Give the Review title, choose the Successful current directory read, and choose the Assigned reviewer.
  3. Set the Review due time and describe the Account review purpose. Tick the box approving use of the private directory inventory.
  4. Give a Reason and press Save.

Decide each account

The assigned reviewer presses Review account on each account and chooses a Decision:

  • Retain account: it stays.
  • Removal required: it must go.
  • Time-bound exception: it stays for now. Give the Exception expiry, at most 90 days ahead. A different company manager must review it.

For an account marked for removal, press Record removal intent to record what was asked of your Google administrator. This does not suspend, archive or delete the account. Ask for a fresh directory read in People & access afterwards to confirm it.

Review an exception

Someone other than the person who proposed it presses Review exception, reads the Proposed account exception, and chooses Accept bounded risk or Return for correction.

Close the review

When every account is decided, an owner or editor presses Close review. To abandon it, press Cancel review. Open Retained history to read every decision. Press Export review history (JSON) to keep a copy.

Common questions

"Does marking an account for removal remove it?" No. Remove it in Google, then let a fresh directory read confirm it.

"Can a contributor be the reviewer?" Yes. Any current company member can be assigned, and they work from My work.

Can’t find what you need? Contact us.