How to Run a SOC 2 Access Review in Google Workspace
Google Workspace is usually the root identity for SaaS companies — Google SSO connects to Slack, GitHub, Jira, Notion, and dozens of other tools. A compromised or stale Google Workspace account can cascade into access across your entire stack. This guide walks you through producing CC6.1, CC6.2, and CC6.3 evidence using the Google Admin Console, covering regular users, delegated admins, Super Admins, service accounts, and third-party app authorisations.
Prerequisites
- Google Workspace Super Admin access (not just User Management Admin — you need the full export capability)
- Our free SOC 2 Access Review Template (download below) — to paste your findings into
- A list of in-scope systems connected via Google SSO — you'll need this to document scope completeness
What evidence you'll produce
- • User export CSV (all active users, suspension status, last sign-in — CC6.3 completeness)
- • Admin roles export (all Super Admins and delegated admins with role names — CC6.1 least privilege)
- • Completed access review spreadsheet (reviewer name, dates, decisions — CC6.3 primary evidence)
- • Third-party app authorisation list (OAuth apps with data scopes — CC6.1 scope control)
- • MFA enrollment report (all admin accounts confirmed with MFA — CC6.1)
Export all users from Google Admin Console
5–10 minutes
Navigation path:
admin.google.com → Directory → Users → All users
How to export:
- In the user list, click the Download users icon (top right, looks like a download arrow)
- Select All columns — not just default columns. You need the Last sign-in and MFA columns.
- Choose CSV format and click Download.
Key columns to review in the export:
- Account status: Should be Active for current employees. Any Suspended rows are accounts that were disabled but not yet deleted — verify this was intentional.
- Last sign-in time: Your stale account signal. Any account not used in 90+ days with no documented justification (e.g., parental leave) should be reviewed for revocation.
- 2-step verification enrolled: All admin accounts must show True. Any admin with 2SV = False is a CC6.1 finding.
- User type: Distinguishes users vs service accounts vs shared mailboxes.
# Alternative: export via Admin SDK Reports API
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/token?maxResults=500
Export all admin roles and assignments
10–15 minutes
Super Admins:
admin.google.com → Account → Admin roles → Super Admin → Assigned admins. This shows every user with full Super Admin access.
Delegated admins (custom roles):
admin.google.com → Account → Admin roles → [Custom role name] → Assigned admins. Repeat for each custom role (User Management Admin, Groups Admin, Help Desk Admin, etc.).
For a complete role inventory, use the Admin SDK via curl:
# List all admin role assignments
curl -H "Authorization: Bearer $(gcloud auth print-access-token)"
"https://admin.googleapis.com/admin/directory/v1/customer/my_customer/roleassignments"
For each Super Admin, you must document:
- Why they need Super Admin rather than a scoped delegated admin role
- What they specifically use Super Admin access for (emergency incident response? SSO configuration? user lifecycle management?)
- Who approved the Super Admin role (CC6.2 approval chain)
- When it was last reviewed (CC6.3)
Review third-party app authorisations
10–15 minutes
Navigation path:
admin.google.com → Security → API controls → App access control → Manage third-party app access
This shows every OAuth application your users have granted access to Google data. Many companies are surprised by how long this list is — employees authorise apps individually, often without IT knowledge.
Review each app for:
- Data scope: Apps with Drive, Gmail, or Admin SDK access are high risk. Apps with only profile access (name, email) are low risk.
- User count: An app authorised by 1 person is probably individual — an app authorised by 50 people might be shadow IT.
- Trusted status: Apps not explicitly marked as "trusted by admin" can be blocked via the Restricted Apps policy.
- Last used: Apps not accessed in 90+ days should be reviewed for revocation.
Identify service accounts and shared mailboxes
5 minutes
Service accounts (e.g., [email protected], [email protected]) and shared mailboxes (e.g., [email protected], [email protected]) must appear in your access review as separate rows.
For each service account, document:
- User Type: "Service Account" — not Employee
- Named owner: A specific human responsible for this account (e.g., "Dave Kelly, DevOps")
- Purpose: What does this account do? What does it have access to?
- MFA status: Service accounts typically don't have MFA — this is acceptable only if the account's password is stored in your password manager and rotated regularly
For shared mailboxes:
- Who has send-as access? This is full email impersonation capability.
- Are any shared mailboxes delegated to personal accounts? Delegation grants full read/send access to another user's mailbox.
Populate and run the access review
15–20 minutes (plus reviewer time)
Open the access review template. Paste your exported users into the spreadsheet — one row per person. Set up the formulas:
# In the "Next Review Due" column (assuming Last Review Date is column Q):
=Q2+90
# In the "Days Since Last Review" column:
=TODAY()-Q2
# Conditional formatting formula for overdue (red):
=AND(ISNUMBER(S2),S2>90)
# Conditional formatting formula for due soon (amber):
=AND(ISNUMBER(S2),S2>60,S2<=90)
Sending the review to system owners:
Share the spreadsheet (or the relevant rows) with the Google Workspace admin (usually IT or Engineering Manager) and ask them to review each row and document:
- Is this access still needed? (Is the person still in the same role?)
- Is the access level still appropriate? (Should this person still be a Super Admin?)
- Any concerns about the last login date? (Account unused for 6 months?)
Revoke stale or unnecessary access
Varies — act the same day
For any row marked Revoked or Access Downgraded:
- Suspend a user account: Admin Console → Directory → Users → [user] → More options → Suspend. Do NOT delete — deletion is immediate and irreversible.
- Remove Super Admin: Admin Console → Account → Admin roles → Super Admin → Assigned admins → Remove [user].
- Remove a delegated admin role: Admin Console → Account → Admin roles → [role] → Assigned admins → Remove.
- Revoke OAuth app: Admin Console → Security → API controls → App access control → [app] → Revoke access for all users.
After each revocation:
Take a screenshot of the updated state (suspended account, empty role assignment list, or revoked app). This is your secondary evidence. Record the revocation date in the review spreadsheet Notes column.
Archive and prepare for the auditor
10 minutes
Archive the following per review cycle:
- access-review-google-workspace-2025-Q1.xlsx — completed review with all rows closed out
- google-user-export-2025-01-10.csv — the raw export you started from
- admin-roles-export-2025-01-10.csv or screenshots of admin role assignments
- Screenshots for any Revoked rows (suspended account, role removal confirmation)
Set your next review reminder:
Create a recurring calendar event 90 days from today. Don't rely on memory. SOC 2 Type II auditors test whether your cadence is consistent — an 88-day gap and a 93-day gap will both be noted.
Evidence quality checklist — before you close the review
- Every user row has a reviewer name (not blank, not 'IT Team')
- Every row has a review date within 90 days of the prior review
- Zero rows have 'Pending' or blank status
- Every admin row has a specific written business justification
- Every Revoked row has a revocation date and screenshot attached
- Service accounts have a named owner and access key rotation date
- No user reviewed their own access (segregation of duties maintained)
- Review was signed off by the IT Manager or CISO
Common mistakes that cause findings
- ❌ Only reviewing the last 30 days of users
→ Export all users including those not recently active — last sign-in of 120 days ago is still an active account.
- ❌ Treating a suspended account as 'revoked' without noting when it was suspended
→ Revocation date must be documented. 'Already suspended' is not a review status — document when the suspension happened and whether it was per the review or a prior action.
- ❌ Not reviewing Google Groups with external members
→ Google Groups can have external (non-org) members. Check each group for external membership — this is a data-sharing risk.
- ❌ Completing the review then not setting a 90-day reminder
→ The cadence is as important as the review itself. Set a calendar reminder before closing the review.
Run this review every 90 days
AllowNow gives you a structured place to track every user, service, and access decision. Import your team, assign roles and services, and generate audit-ready PDF reports in one click. Every approval and revocation is logged with who reviewed it and when.