Audit logs for Google Workspace

This document provides a conceptual overview of the audit logs that Google Workspace provides as a part of Cloud Audit Logs.

For information about managing your Google Workspace audit logs, see View and manage audit logs for Google Workspace.

Overview

Google Cloud services write audit logs to help you answer the questions, "Who did what, where, and when?". You can share your Google Workspace audit logs with Google Cloud to store, analyze, monitor, and alert on your Google Workspace data.

Audit logs for Google Workspace are available for Cloud Identity, Cloud Identity Premium, and all Google Workspace customers.

If you've enabled Google Workspace data sharing with Google Cloud, then audit logs are always enabled for Google Workspace.

Disabling Google Workspace data sharing stops new Google Workspace audit log events from being sent to Google Cloud. Any existing logs remain through their default retention periods, unless you have configured custom retention to retain your logs for a longer period.

If you don't enable Google Workspace data sharing with Google Cloud, then you can't see audit logs for Google Workspace in Google Cloud.

Types of audit logs

Admin Activity audit logs contain log entries for API calls or other actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Identity and Access Management (IAM) permissions.

Data Access audit logs contain API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data. Data Access audit logs don't record the data-access operations on resources that are publicly shared (available to All Users or All Authenticated Users) or that can be accessed without logging into Google Cloud, Google Workspace, Cloud Identity, or Drive Enterprise account.

Google Workspace services forwarding audit logs to Google Cloud

Google Workspace provides the following audit logs at the Google Cloud organization level:

  • Access Transparency: Access Transparency logs provide a record of actions when Google personnel access customer content in your Google Workspace resources. In contrast to Access Transparency, Cloud Audit Logs record the actions that members of your Google Cloud organization have taken in your Google Cloud resources.

    For more information about the structure of Access Transparency logs and the types of accesses that are logged, see Log field descriptions.

  • Google Workspace Admin Audit: Admin Audit logs provide a record of actions performed in your Google Admin console. For example, you can see when an administrator added a user or turned on a Google Workspace service.

    Admin Audit writes Admin Activity audit logs only.

  • Google Workspace Enterprise Groups Audit: Enterprise Groups Audit logs provide a record of actions performed on groups and group memberships. For example, you can see when an administrator added a user or when a group owner deleted their group.

    Enterprise Groups Audit writes Admin Activity audit logs only.

  • Google Workspace Login Audit: Login Audit logs track user sign-ins to your domain. These logs only record the login event. They don't record which system was used to perform the login action.

    Login Audit writes Data Access audit logs only.

  • Google Workspace OAuth Token Audit: OAuth Token Audit logs track which users are using which third-party mobile or web applications in your domain. For example, when a user opens a Google Workspace Marketplace app, the log records the name of the app and the person using it. The log also records each time a third-party application is authorized to access Google Account data, such as Google Contacts, Calendar, and Drive files (Google Workspace only).

    OAuth Token Audit writes both Admin Activity and Data Access audit logs.

  • Google Workspace SAML Audit: SAML Audit logs track users' successful and failed sign-ins to SAML applications. Entries usually appear within an hour of the user action.

    SAML Audit writes Data Access audit logs only.

Service-specific information

Details for each Google Workspace service's audit logs are as follows:

Google Workspace Admin Audit audit logs use the resource type audited_resource for all audit logs.

Google Workspace Admin Audit audit logs use the service name admin.googleapis.com.

Google Workspace Admin Audit writes Admin Activity audit logs only. The following are the audited operations:

Activity type AuditLog.method_name
AI_CLASSIFICATION_SETTINGS google.admin.AdminService.aiClassificationInsufficientTrainingExamples
google.admin.AdminService.aiClassificationModelLowScore
google.admin.AdminService.aiClassificationNewModelReady
ALERT_CENTER google.admin.AdminService.alertCenterBatchDeleteAlerts
google.admin.AdminService.alertCenterBatchUndeleteAlerts
google.admin.AdminService.alertCenterCreateAlert
google.admin.AdminService.alertCenterCreateFeedback
google.admin.AdminService.alertCenterDeleteAlert
google.admin.AdminService.alertCenterGetAlertMetadata
google.admin.AdminService.alertCenterGetCustomerSettings
google.admin.AdminService.alertCenterGetSitLink
google.admin.AdminService.alertCenterListChange
google.admin.AdminService.alertCenterListFeedback
google.admin.AdminService.alertCenterListRelatedAlerts
google.admin.AdminService.alertCenterUndeleteAlert
google.admin.AdminService.alertCenterUpdateAlert
google.admin.AdminService.alertCenterUpdateAlertMetadata
google.admin.AdminService.alertCenterUpdateCustomerSettings
google.admin.AdminService.alertCenterView
APPLICATION_SETTINGS google.admin.AdminService.changeApplicationSetting
google.admin.AdminService.createApplicationSetting
google.admin.AdminService.deleteApplicationSetting
google.admin.AdminService.reorderGroupBasedPoliciesEvent
google.admin.AdminService.gplusPremiumFeatures
google.admin.AdminService.createManagedConfiguration
google.admin.AdminService.deleteManagedConfiguration
google.admin.AdminService.updateManagedConfiguration
google.admin.AdminService.flashlightEduNonFeaturedServicesSelected
CALENDAR_SETTINGS google.admin.AdminService.createBuilding
google.admin.AdminService.deleteBuilding
google.admin.AdminService.updateBuilding
google.admin.AdminService.createCalendarResource
google.admin.AdminService.deleteCalendarResource
google.admin.AdminService.createCalendarResourceFeature
google.admin.AdminService.deleteCalendarResourceFeature
google.admin.AdminService.updateCalendarResourceFeature
google.admin.AdminService.renameCalendarResource
google.admin.AdminService.updateCalendarResource
google.admin.AdminService.changeCalendarSetting
google.admin.AdminService.cancelCalendarEvents
google.admin.AdminService.releaseCalendarResources
CHAT_SETTINGS google.admin.AdminService.meetInteropCreateGateway
google.admin.AdminService.meetInteropDeleteGateway
google.admin.AdminService.meetInteropModifyGateway
google.admin.AdminService.changeChatSetting
CHROME_OS_SETTINGS google.admin.AdminService.changeChromeOsAndroidApplicationSetting
google.admin.AdminService.changeChromeOsApplicationSetting
google.admin.AdminService.sendChromeOsDeviceCommand
google.admin.AdminService.changeChromeOsDeviceAnnotation
google.admin.AdminService.changeChromeOsDeviceSetting
google.admin.AdminService.changeChromeOsDeviceState
google.admin.AdminService.changeChromeOsPublicSessionSetting
google.admin.AdminService.insertChromeOsPrinter
google.admin.AdminService.deleteChromeOsPrinter
google.admin.AdminService.updateChromeOsPrinter
google.admin.AdminService.changeChromeOsSetting
google.admin.AdminService.changeChromeOsUserSetting
google.admin.AdminService.removeChromeOsApplicationSettings
CONTACTS_SETTINGS google.admin.AdminService.changeContactsSetting
DELEGATED_ADMIN_SETTINGS google.admin.AdminService.assignRole
google.admin.AdminService.createRole
google.admin.AdminService.deleteRole
google.admin.AdminService.addPrivilege
google.admin.AdminService.removePrivilege
google.admin.AdminService.renameRole
google.admin.AdminService.updateRole
google.admin.AdminService.unassignRole
DEVICE_SETTINGS google.admin.AdminService.deleteDevice
google.admin.AdminService.moveDeviceToOrgUnit
DOCS_SETTINGS google.admin.AdminService.transferDocumentOwnership
google.admin.AdminService.driveDataRestore
google.admin.AdminService.changeDocsSetting
DOMAIN_SETTINGS google.admin.AdminService.changeAccountAutoRenewal
google.admin.AdminService.addApplication
google.admin.AdminService.addApplicationToWhitelist
google.admin.AdminService.changeAdvertisementOption
google.admin.AdminService.createAlert
google.admin.AdminService.changeAlertCriteria
google.admin.AdminService.deleteAlert
google.admin.AdminService.alertReceiversChanged
google.admin.AdminService.renameAlert
google.admin.AdminService.alertStatusChanged
google.admin.AdminService.addDomainAlias
google.admin.AdminService.removeDomainAlias
google.admin.AdminService.skipDomainAliasMx
google.admin.AdminService.verifyDomainAliasMx
google.admin.AdminService.verifyDomainAlias
google.admin.AdminService.toggleOauthAccessToAllApis
google.admin.AdminService.toggleAllowAdminPasswordReset
google.admin.AdminService.enableApiAccess
google.admin.AdminService.authorizeApiClientAccess
google.admin.AdminService.removeApiClientAccess
google.admin.AdminService.chromeLicensesRedeemed
google.admin.AdminService.toggleAutoAddNewService
google.admin.AdminService.changePrimaryDomain
google.admin.AdminService.changeWhitelistSetting
google.admin.AdminService.communicationPreferencesSettingChange
google.admin.AdminService.changeConflictAccountAction
google.admin.AdminService.enableFeedbackSolicitation
google.admin.AdminService.toggleContactSharing
google.admin.AdminService.createPlayForWorkToken
google.admin.AdminService.toggleUseCustomLogo
google.admin.AdminService.changeCustomLogo
google.admin.AdminService.changeDataLocalizationForRussia
google.admin.AdminService.changeDataLocalizationSetting
google.admin.AdminService.changeDataProtectionOfficerContactInfo
google.admin.AdminService.deletePlayForWorkToken
google.admin.AdminService.viewDnsLoginDetails
google.admin.AdminService.changeDomainDefaultLocale
google.admin.AdminService.changeDomainDefaultTimezone
google.admin.AdminService.changeDomainName
google.admin.AdminService.toggleEnablePreReleaseFeatures
google.admin.AdminService.changeDomainSupportMessage
google.admin.AdminService.addTrustedDomains
google.admin.AdminService.removeTrustedDomains
google.admin.AdminService.changeEduType
google.admin.AdminService.toggleEnableOauthConsumerKey
google.admin.AdminService.toggleSsoEnabled
google.admin.AdminService.toggleSsl
google.admin.AdminService.changeEuRepresentativeContactInfo
google.admin.AdminService.generateTransferToken
google.admin.AdminService.changeLoginBackgroundColor
google.admin.AdminService.changeLoginBorderColor
google.admin.AdminService.changeLoginActivityTrace
google.admin.AdminService.playForWorkEnroll
google.admin.AdminService.playForWorkUnenroll
google.admin.AdminService.mxRecordVerificationClaim
google.admin.AdminService.toggleNewAppFeatures
google.admin.AdminService.toggleUseNextGenControlPanel
google.admin.AdminService.uploadOauthCertificate
google.admin.AdminService.regenerateOauthConsumerSecret
google.admin.AdminService.toggleOpenIdEnabled
google.admin.AdminService.changeOrganizationName
google.admin.AdminService.toggleOutboundRelay
google.admin.AdminService.changePasswordMaxLength
google.admin.AdminService.changePasswordMinLength
google.admin.AdminService.updateDomainPrimaryAdminEmail
google.admin.AdminService.enableServiceOrFeatureNotifications
google.admin.AdminService.removeApplication
google.admin.AdminService.removeApplicationFromWhitelist
google.admin.AdminService.changeRenewDomainRegistration
google.admin.AdminService.changeResellerAccess
google.admin.AdminService.ruleActionsChanged
google.admin.AdminService.createRule
google.admin.AdminService.changeRuleCriteria
google.admin.AdminService.deleteRule
google.admin.AdminService.renameRule
google.admin.AdminService.ruleStatusChanged
google.admin.AdminService.addSecondaryDomain
google.admin.AdminService.removeSecondaryDomain
google.admin.AdminService.skipSecondaryDomainMx
google.admin.AdminService.verifySecondaryDomainMx
google.admin.AdminService.verifySecondaryDomain
google.admin.AdminService.updateDomainSecondaryEmail
google.admin.AdminService.changeSsoSettings
google.admin.AdminService.generatePin
google.admin.AdminService.updateRule
EMAIL_SETTINGS google.admin.AdminService.dropFromQuarantine
google.admin.AdminService.emailLogSearch
google.admin.AdminService.emailUndelete
google.admin.AdminService.changeEmailSetting
google.admin.AdminService.changeGmailSetting
google.admin.AdminService.createGmailSetting
google.admin.AdminService.deleteGmailSetting
google.admin.AdminService.rejectFromQuarantine
google.admin.AdminService.releaseFromQuarantine
GROUP_SETTINGS google.admin.AdminService.createGroup
google.admin.AdminService.deleteGroup
google.admin.AdminService.changeGroupDescription
google.admin.AdminService.groupListDownload
google.admin.AdminService.addGroupMember
google.admin.AdminService.removeGroupMember
google.admin.AdminService.updateGroupMember
google.admin.AdminService.updateGroupMemberDeliverySettings
google.admin.AdminService.updateGroupMemberDeliverySettingsCanEmailOverride
google.admin.AdminService.groupMemberBulkUpload
google.admin.AdminService.groupMembersDownload
google.admin.AdminService.changeGroupEmail
google.admin.AdminService.changeGroupName
google.admin.AdminService.changeGroupSetting
google.admin.AdminService.whitelistedGroupsUpdated
LABELS google.admin.AdminService.labelDeleted
google.admin.AdminService.labelDisabled
google.admin.AdminService.labelReenabled
google.admin.AdminService.labelPermissionUpdated
google.admin.AdminService.labelPermissionDeleted
google.admin.AdminService.labelPublished
google.admin.AdminService.labelCreated
google.admin.AdminService.labelUpdated
LICENSES_SETTINGS google.admin.AdminService.orgUsersLicenseAssignment
google.admin.AdminService.orgAllUsersLicenseAssignment
google.admin.AdminService.userLicenseAssignment
google.admin.AdminService.changeLicenseAutoAssign
google.admin.AdminService.userLicenseReassignment
google.admin.AdminService.orgLicenseRevoke
google.admin.AdminService.userLicenseRevoke
google.admin.AdminService.updateDynamicLicense
google.admin.AdminService.licenseUsageUpdate
MOBILE_SETTINGS google.admin.AdminService.actionCancelled
google.admin.AdminService.actionRequested
google.admin.AdminService.addMobileCertificate
google.admin.AdminService.companyDevicesBulkCreation
google.admin.AdminService.companyOwnedDeviceBlocked
google.admin.AdminService.companyDeviceDeletion
google.admin.AdminService.companyOwnedDeviceUnblocked
google.admin.AdminService.companyOwnedDeviceWiped
google.admin.AdminService.changeMobileApplicationPermissionGrant
google.admin.AdminService.changeMobileApplicationPriorityOrder
google.admin.AdminService.removeMobileApplicationFromWhitelist
google.admin.AdminService.changeMobileApplicationSettings
google.admin.AdminService.addMobileApplicationToWhitelist
google.admin.AdminService.mobileDeviceApprove
google.admin.AdminService.mobileDeviceBlock
google.admin.AdminService.mobileDeviceDelete
google.admin.AdminService.mobileDeviceWipe
google.admin.AdminService.changeMobileSetting
google.admin.AdminService.changeAdminRestrictionsPin
google.admin.AdminService.changeMobileWirelessNetwork
google.admin.AdminService.addMobileWirelessNetwork
google.admin.AdminService.removeMobileWirelessNetwork
google.admin.AdminService.changeMobileWirelessNetworkPassword
google.admin.AdminService.removeMobileCertificate
google.admin.AdminService.enrollForGoogleDeviceManagement
google.admin.AdminService.useGoogleMobileManagement
google.admin.AdminService.useGoogleMobileManagementForNonIos
google.admin.AdminService.useGoogleMobileManagementForIos
google.admin.AdminService.mobileAccountWipe
google.admin.AdminService.mobileDeviceCancelWipeThenApprove
google.admin.AdminService.mobileDeviceCancelWipeThenBlock
ORG_SETTINGS google.admin.AdminService.chromeLicensesEnabled
google.admin.AdminService.chromeApplicationLicenseReservationCreated
google.admin.AdminService.chromeApplicationLicenseReservationDeleted
google.admin.AdminService.chromeApplicationLicenseReservationUpdated
google.admin.AdminService.assignCustomLogo
google.admin.AdminService.unassignCustomLogo
google.admin.AdminService.createEnrollmentToken
google.admin.AdminService.revokeEnrollmentToken
google.admin.AdminService.chromeLicensesAllowed
google.admin.AdminService.createOrgUnit
google.admin.AdminService.removeOrgUnit
google.admin.AdminService.editOrgUnitDescription
google.admin.AdminService.moveOrgUnit
google.admin.AdminService.editOrgUnitName
google.admin.AdminService.toggleServiceEnabled
SECURITY_INVESTIGATION google.admin.AdminService.securityInvestigationAction
google.admin.AdminService.securityInvestigationActionCancellation
google.admin.AdminService.securityInvestigationActionCompletion
google.admin.AdminService.securityInvestigationActionRetry
google.admin.AdminService.securityInvestigationActionVerificationConfirmation
google.admin.AdminService.securityInvestigationActionVerificationRequest
google.admin.AdminService.securityInvestigationActionVerificationRequestExpiration
google.admin.AdminService.securityInvestigationChartCreate
google.admin.AdminService.securityInvestigationContentAccess
google.admin.AdminService.securityInvestigationDownloadAttachment
google.admin.AdminService.securityInvestigationExportActionResults
google.admin.AdminService.securityInvestigationExportQuery
google.admin.AdminService.securityInvestigationObjectCreateDraftInvestigation
google.admin.AdminService.securityInvestigationObjectDeleteInvestigation
google.admin.AdminService.securityInvestigationObjectDuplicateInvestigation
google.admin.AdminService.securityInvestigationObjectOwnershipTransfer
google.admin.AdminService.securityInvestigationObjectSaveInvestigation
google.admin.AdminService.securityInvestigationObjectUpdateDirectSharing
google.admin.AdminService.securityInvestigationObjectUpdateLinkSharing
google.admin.AdminService.securityInvestigationQuery
google.admin.AdminService.securityInvestigationSettingUpdate
SECURITY_SETTINGS google.admin.AdminService.addToTrustedOauth2Apps
google.admin.AdminService.allowAspWithout2Sv
google.admin.AdminService.allowServiceForOauth2Access
google.admin.AdminService.allowStrongAuthentication
google.admin.AdminService.blockOnDeviceAccess
google.admin.AdminService.changeAllowedTwoStepVerificationMethods
google.admin.AdminService.changeAppAccessSettingsCollectionId
google.admin.AdminService.changeCaaAppAssignments
google.admin.AdminService.changeCaaDefaultAssignments
google.admin.AdminService.changeCaaErrorMessage
google.admin.AdminService.changeSessionLength
google.admin.AdminService.changeTwoStepVerificationEnrollmentPeriodDuration
google.admin.AdminService.changeTwoStepVerificationFrequency
google.admin.AdminService.changeTwoStepVerificationGracePeriodDuration
google.admin.AdminService.changeTwoStepVerificationStartDate
google.admin.AdminService.disallowServiceForOauth2Access
google.admin.AdminService.enableNonAdminUserPasswordRecovery
google.admin.AdminService.enforceStrongAuthentication
google.admin.AdminService.removeFromTrustedOauth2Apps
google.admin.AdminService.sessionControlSettingsChange
google.admin.AdminService.toggleCaaEnablement
google.admin.AdminService.trustDomainOwnedOauth2Apps
google.admin.AdminService.unblockOnDeviceAccess
google.admin.AdminService.untrustDomainOwnedOauth2Apps
google.admin.AdminService.updateErrorMsgForRestrictedOauth2Apps
google.admin.AdminService.weakProgrammaticLoginSettingsChanged
SITES_SETTINGS google.admin.AdminService.addWebAddress
google.admin.AdminService.deleteWebAddress
google.admin.AdminService.changeSitesSetting
google.admin.AdminService.changeSitesWebAddressMappingUpdates
google.admin.AdminService.viewSiteDetails
USER_SETTINGS google.admin.AdminService.delete2SvScratchCodes
google.admin.AdminService.generate2SvScratchCodes
google.admin.AdminService.revoke3LoDeviceTokens
google.admin.AdminService.revoke3LoToken
google.admin.AdminService.addRecoveryEmail
google.admin.AdminService.addRecoveryPhone
google.admin.AdminService.grantAdminPrivilege
google.admin.AdminService.revokeAdminPrivilege
google.admin.AdminService.revokeAsp
google.admin.AdminService.toggleAutomaticContactSharing
google.admin.AdminService.bulkUpload
google.admin.AdminService.bulkUploadNotificationSent
google.admin.AdminService.cancelUserInvite
google.admin.AdminService.changeUserCustomField
google.admin.AdminService.changeUserExternalId
google.admin.AdminService.changeUserGender
google.admin.AdminService.changeUserIm
google.admin.AdminService.enableUserIpWhitelist
google.admin.AdminService.changeUserKeyword
google.admin.AdminService.changeUserLanguage
google.admin.AdminService.changeUserLocation
google.admin.AdminService.changeUserOrganization
google.admin.AdminService.changeUserPhoneNumber
google.admin.AdminService.changeRecoveryEmail
google.admin.AdminService.changeRecoveryPhone
google.admin.AdminService.changeUserRelation
google.admin.AdminService.changeUserAddress
google.admin.AdminService.createEmailMonitor
google.admin.AdminService.createDataTransferRequest
google.admin.AdminService.grantDelegatedAdminPrivileges
google.admin.AdminService.deleteAccountInfoDump
google.admin.AdminService.deleteEmailMonitor
google.admin.AdminService.deleteMailboxDump
google.admin.AdminService.changeFirstName
google.admin.AdminService.gmailResetUser
google.admin.AdminService.changeLastName
google.admin.AdminService.mailRoutingDestinationAdded
google.admin.AdminService.mailRoutingDestinationRemoved
google.admin.AdminService.addNickname
google.admin.AdminService.removeNickname
google.admin.AdminService.changePassword
google.admin.AdminService.changePasswordOnNextLogin
google.admin.AdminService.downloadPendingInvitesList
google.admin.AdminService.removeRecoveryEmail
google.admin.AdminService.removeRecoveryPhone
google.admin.AdminService.requestAccountInfo
google.admin.AdminService.requestMailboxDump
google.admin.AdminService.resendUserInvite
google.admin.AdminService.resetSigninCookies
google.admin.AdminService.securityKeyRegisteredForUser
google.admin.AdminService.revokeSecurityKey
google.admin.AdminService.userInvite
google.admin.AdminService.viewTempPassword
google.admin.AdminService.turnOff2StepVerification
google.admin.AdminService.unblockUserSession
google.admin.AdminService.unenrollUserFromTitanium
google.admin.AdminService.archiveUser
google.admin.AdminService.updateBirthdate
google.admin.AdminService.createUser
google.admin.AdminService.deleteUser
google.admin.AdminService.downgradeUserFromGplus
google.admin.AdminService.userEnrolledInTwoStepVerification
google.admin.AdminService.downloadUserlistCsv
google.admin.AdminService.moveUserToOrgUnit
google.admin.AdminService.userPutInTwoStepVerificationGracePeriod
google.admin.AdminService.renameUser
google.admin.AdminService.unenrollUserFromStrongAuth
google.admin.AdminService.suspendUser
google.admin.AdminService.unarchiveUser
google.admin.AdminService.undeleteUser
google.admin.AdminService.unsuspendUser
google.admin.AdminService.upgradeUserToGplus
google.admin.AdminService.usersBulkUpload
google.admin.AdminService.usersBulkUploadNotificationSent
Google Workspace Enterprise Groups Audit audit logs use the resource type audited_resource for all audit logs.

Google Workspace Enterprise Groups Audit audit logs use the service name cloudidentity.googleapis.com.

Google Workspace Enterprise Groups Audit writes Admin Activity audit logs only. The following are the audited operations:

Audit logs category
AuditLog.method_name
Admin Activity audit logs google.apps.cloudidentity.groups.v1.GroupsService.UpdateGroup
google.apps.cloudidentity.groups.v1.MembershipsService.UpdateMembership
All Google Workspace Login Audit audit logs use the resource type audited_resource.

Google Workspace Login Audit audit logs use the service name login.googleapis.com.

Google Workspace Login Audit writes Data Access audit logs only. The following are the audited operations; log samples for each operation are available.

Audit logs category AuditLog.method_name
Data Access audit logs google.login.LoginService.2svDisable
google.login.LoginService.2svEnroll
google.login.LoginService.accountDisabledPasswordLeak
google.login.LoginService.accountDisabledGeneric
google.login.LoginService.accountDisabledSpammingThroughRelay
google.login.LoginService.accountDisabledSpamming
google.login.LoginService.accountDisabledHijacked
google.login.LoginService.emailForwardingOutOfDomain
google.login.LoginService.govAttackWarning
google.login.LoginService.loginChallenge
google.login.LoginService.loginFailure
google.login.LoginService.loginVerification
google.login.LoginService.logout
google.login.LoginService.loginSuccess
google.login.LoginService.passwordEdit
google.login.LoginService.recoveryEmailEdit
google.login.LoginService.recoveryPhoneEdit
google.login.LoginService.recoverySecretQaEdit
google.login.LoginService.riskySensitiveActionAllowed
google.login.LoginService.riskySensitiveActionBlocked
google.login.LoginService.suspiciousLogin
google.login.LoginService.suspiciousLoginLessSecureApp
google.login.LoginService.suspiciousProgrammaticLogin
google.login.LoginService.titaniumEnroll
google.login.LoginService.titaniumUnenroll
Google Workspace OAuth Token Audit audit logs use the resource type audited_resource for all audit logs.

Google Workspace OAuth Token Audit audit logs use the service name oauth2.googleapis.com.

Google Workspace OAuth Token Audit writes both Admin Activity and Data Access audit logs. The following are the audited operations:

Audit logs category
AuditLog.method_name
Admin Activity audit logs google.identity.oauth2.Deny
google.identity.oauth2.GetToken
google.identity.oauth2.Request
google.identity.oauth2.RevokeToken
Data Access audit logs google.identity.oauth2.GetTokenInfo
Google Workspace SAML Audit audit logs use the resource type audited_resource for all audit logs.

Google Workspace SAML Audit audit logs use the service name login.googleapis.com.

Google Workspace SAML Audit writes Data Access audit logs only. The following are the audited operations:

Audit logs category
AuditLog.method_name
Data Access audit logs google.apps.login.v1.SamlLoginFailed
google.apps.login.v1.SamlLoginSucceeded

Audit log permissions

IAM permissions and roles determine your ability to access audit logs data in the Logging API, the Logs Explorer, and the Google Cloud CLI.

For detailed information about the organization-level IAM permissions and roles you might need, see the Access control with IAM.

Audit log format

Google Workspace audit log entries include the following objects:

  • The log entry itself, which is an object of type LogEntry. When examining audit logging data, you might find the following useful:

    • logName contains the organization ID and audit log type.
    • resource contains the target of the audited operation.
    • timeStamp contains the time of the audited operation.
    • protoPayload contains the Google Workspace audit log in its metadata field.

The protoPayload.metadata field holds the audited Google Workspace information. The following is an example of a Login Audit log:

{
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "principalEmail": "test-user@example.net"
    },
    "requestMetadata": {
      "callerIp": "2001:db8:ffff:ffff:ffff:ffff:ffff:ffff",
      "requestAttributes": {},
      "destinationAttributes": {}
    },
    "serviceName": "login.googleapis.com",
    "methodName": "google.login.LoginService.loginFailure",
    "resourceName": "organizations/123",
    "metadata": {
      "event": [
        {
          "eventName": "login_failure",
          "eventType": "login",
          "parameter": [
            {
              "value": "google_password",
              "type": "TYPE_STRING",
              "name": "login_type",
            },
            {
              "name": "login_challenge_method",
              "type": "TYPE_STRING",
              "label": "LABEL_REPEATED",
              "multiStrValue": [
                "password",
                "idv_preregistered_phone",
                "idv_preregistered_phone"
              ]
            },
          ]
        }
      ],
      "activityId": {
        "uniqQualifier": "358068855354",
        "timeUsec": "1632500217183212"
      },
      "@type": "type.googleapis.com/ccc_hosted_reporting.ActivityProto"
    }
  },
  "insertId": "-nahbepd4l1x",
  "resource": {
    "type": "audited_resource",
    "labels": {
      "method": "google.login.LoginService.loginFailure",
      "service": "login.googleapis.com"
    }
  },
  "timestamp": "2021-09-24T16:16:57.183212Z",
  "severity": "NOTICE",
  "logName": "organizations/123/logs/cloudaudit.googleapis.com%2Fdata_access",
  "receiveTimestamp": "2021-09-24T17:51:25.034361197Z"
}

For information about service-specific audit logging fields, and how to interpret them, select from the services listed in Available audit logs.

View logs

For information on viewing your Google Workspace audit logs, see View and manage audit logs for Google Workspace.

Route audit logs

You can route Google Workspace audit logs from Cloud Logging to supported destinations, including other Logging buckets.

Here are some applications for routing audit logs:

  • To use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub. Using Pub/Sub, you can route to other applications, other repositories, and to third parties.

  • To manage your audit logs across an entire organization, you can create aggregated sinks that combine and route logs from all the Google Cloud projects, billing accounts, and folders contained by your organization. For instance, you might aggregate and route audit log entries from an organization's folders to a Cloud Storage bucket.

For instructions on routing logs, see Route logs to supported destinations.

Regionalization

You can't choose a region where your Google Workspace logs are stored. Google Workspace logs aren't covered by the Google Workspace Data Region Policy.

Retention periods

The following retention periods apply to your audit logs data:

For each organization, Cloud Logging automatically stores logs in two buckets: a _Default bucket and a _Required bucket. The _Required bucket holds Admin Activity audit logs, System Event audit logs, and Access Transparency logs. The _Default bucket holds all other log entries that aren't stored in the _Required bucket. For more information on Logging buckets, see Routing and storage overview.

You can configure Cloud Logging to retain the logs in the _Default logs bucket for a period ranging from 1 day to 3650 days.

To update the retention period for the _Default logs bucket, see Custom retention.

You can't change the retention period on the _Required bucket.

Quotas and limits

The same quotas apply to audit logs for Google Workspace and Cloud Audit Logs.

For details about these usage limits, including the maximum sizes of audit logs, see Quotas and limits.

Pricing

Google Workspace's organization-level logs are free.

What's next