Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I just accidentally found out that as a Google Apps "super admin", I can see all of my users' calendars and their details regardless of the privacy settings on those calendars or events. Here's Google's support page saying exactly this:

https://support.google.com/a/answer/1084780?hl=en

While I somewhat get this, I'm surprised that there is no way for admins to self-censor. I'd like to be able to see my co-workers free/busy schedule without infringing on their privacy.

The only workaround I could think of is to create a separate admin account, but this has 2 issues: a waste of a user license, and the pain of logging into a different account.

Does anyone else have even a semi-decent way to handle this?

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

If you are specifically concerned about personal events, we handle it with personal Gmail accounts.

For example, John Doe has a GAPPS account john.doe@example.com and a personal account john.doe@gmail.com. From the john.doe@gmail.com, he shares his calendar with full access and manage sharing. When logged in at work, personal events are saved into the john.doe@gmail.com calendar. Work events are saved into the john.doe@example.com calendar.

The result is personal events are not automatically shared with admins. If a user leaves the company, they take their personal calendar with them.

Also, they can share their personal calendar with an admin person on a free-busy basis.

share|improve this answer
    
Thanks @Weehooey. That's a neat approach (although of course users may not be entirely thrilled!). Just to be totally clear for both me and other readers, I assume you mean that the user john.doe@gmail.com would be sharing their calendar with full access to their work self (john.doe@example.com)? –  KJH Oct 9 '13 at 1:33
    
Correct. That is what we do. Feedback from our users is they appreciate the separation of work and personal life. –  Weehooey Oct 9 '13 at 12:28
    
That looks like a good solution. Private stuff is private stuff, and should not be stored in a work account - be it email, calendars or contacts. –  Vidar S. Ramdal Oct 9 '13 at 14:41
add comment

@KJH, I actually prefer the separate admin account model. Super Admin accounts hold the keys to the kingdom - they can permanently and irreversibly delete your Google Apps account. Talk about game over. Here's how the separate admin account can benefit your organization:

  1. It can be more secure (put the new admin accounts in an OU with only essential services turned on - Gmail, Groups Management, etc - and two-step authentication required).
  2. It can reduce the risk of account compromise through phishing, a lost unencrypted Android cell phone, or any of the dozens of Chrome/Drive/Android apps that we expose our accounts and data to.
  3. Basically, you only log into the account when you need to get into the admin console ... the less time you're in the account, the safer it is.
  4. Bonus: you don't have to worry about viewing user calendars anymore.
  5. You can make this relatively convenient for the Super Admins by having them create a new Chrome profile for the new Super Admin account - it's very easy to "switch users" in Chrome to go to that user account.
share|improve this answer
    
Absolutely agree @iowaprodigal. I'm just a bit bummed that we had to chew up an extra user license since we're a fairly small outfit. –  KJH Feb 5 at 0:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.