6

I just accidentally found out that as a Google Apps "super admin", I can see all of my users' calendars and their details regardless of the privacy settings on those calendars or events. Here's Google's support page saying exactly this:

https://support.google.com/a/answer/1084780?hl=en

While I somewhat get this, I'm surprised that there is no way for admins to self-censor. I'd like to be able to see my co-workers free/busy schedule without infringing on their privacy.

The only workaround I could think of is to create a separate admin account, but this has 2 issues: a waste of a user license, and the pain of logging into a different account.

Does anyone else have even a semi-decent way to handle this?

Improve this question

3 Answers 3

Reset to default
4

If you are specifically concerned about personal events, we handle it with personal Gmail accounts.

For example, John Doe has a GAPPS account [email protected] and a personal account [email protected]. From the [email protected], he shares his calendar with full access and manage sharing. When logged in at work, personal events are saved into the [email protected] calendar. Work events are saved into the [email protected] calendar.

The result is personal events are not automatically shared with admins. If a user leaves the company, they take their personal calendar with them.

Also, they can share their personal calendar with an admin person on a free-busy basis.

Improve this answer
3
  • 1
    Thanks @Weehooey. That's a neat approach (although of course users may not be entirely thrilled!). Just to be totally clear for both me and other readers, I assume you mean that the user [email protected] would be sharing their calendar with full access to their work self ([email protected])?
    – KJH
    Commented Oct 9, 2013 at 1:33
  • 1
    Correct. That is what we do. Feedback from our users is they appreciate the separation of work and personal life.
    – Weehooey
    Commented Oct 9, 2013 at 12:28
  • 2
    That looks like a good solution. Private stuff is private stuff, and should not be stored in a work account - be it email, calendars or contacts.
    – Vidar S. Ramdal
    Commented Oct 9, 2013 at 14:41
3

@KJH, I actually prefer the separate admin account model. Super Admin accounts hold the keys to the kingdom - they can permanently and irreversibly delete your Google Apps account. Talk about game over. Here's how the separate admin account can benefit your organization:

  1. It can be more secure (put the new admin accounts in an OU with only essential services turned on - Gmail, Groups Management, etc - and two-step authentication required).
  2. It can reduce the risk of account compromise through phishing, a lost unencrypted Android cell phone, or any of the dozens of Chrome/Drive/Android apps that we expose our accounts and data to.
  3. Basically, you only log into the account when you need to get into the admin console ... the less time you're in the account, the safer it is.
  4. Bonus: you don't have to worry about viewing user calendars anymore.
  5. You can make this relatively convenient for the Super Admins by having them create a new Chrome profile for the new Super Admin account - it's very easy to "switch users" in Chrome to go to that user account.
Improve this answer
2
  • 3
    Absolutely agree @iowaprodigal. I'm just a bit bummed that we had to chew up an extra user license since we're a fairly small outfit.
    – KJH
    Commented Feb 5, 2014 at 0:07
  • Another reminder that Google doesn't seem to get how most businesses are run. When dealing with a wide range of corporate clients, granularity is absolutely necessary, especially when it comes to security settings. It feels more and more like Google is adopting Microsoft's old model of "do it our way because we know best".
    – Aaron J Spetner
    Commented Mar 2, 2017 at 16:08
0

I know this is old, but just wanted to confirm it's still problem. Transcript from my chat today with G Suite Contact Us. They still owe me a call from a higher level support person. At the very least it would be nice for them to highlight the issues with using your business e-mail as a super admin and just provide a real super admin account for free. Even @Jordan above makes the case that it's best to turn off everything else.

Me: i am a super admin user as well as my partner, but we would prefer a less omnipotent user as our personal accounts. do we need to create a "non-person" account to act as the super user?

Google Support: Yes but in order for us to do that you need to assign another super admin into your account

Me: so do i need to pay for an additional "non-personal" user that acts as the super admin?

Google Support: is there another admin in your account?

Me: yes, but he doesn't need that access either.

Me: none of us wants automatic visibility into other calendars except free/busy

Google Support: that would be correct if no one of the current admins wants to have admin access you need to create another user that can be admin

Me: it's an unfortunate structure. a simple on/off switch for the super admin would solve the problem

Google Support: well someone has to be a super admin to have full control of the Admin Console Allen

Me: i get that we need a super admin for the admin console, but the Calendar is arguably not that

Me: it makes no sense

Google Support: let me check on this one Allen, but as a super admin it is one of its privilege

Me: it should be analogous to e-mail

Google Support: for the email you won´t be able to sign in unless you change the password

Me: as it should be -- their calendar should be similarly private and secure

Google Support: for the calendar you can view the events and not have the right to change it

Me: that's not how it works - i can view and change anything on any calendar

Google Support: oh really let me double check on that

Me: my coworkers are listed under "My Calendars"

Google Support: We can resolve this through the Admin Console

Me: ok

Google Support: can you please login into your G Suite Admin Console? and then click on Apps>G Suite> and then click on Calendar please click on General settings

Me: k

Google Support: and then there is a option in there that says Internal sharing options for secondary calendars

Google Support: please select no sharing if you do not want to see your users calendars

Me: Note on page: Users will be able to change this default setting. Super Admins have 'Make changes and manage sharing' access to all calendars on the domain.

Google Support: but to set your expectation, this setting might take 24 hours to propagate to all users

Me: it says the super admins still retain full access

Me: i don't expect this to fix my issue

Me: support[dot]google[dot]com/a/answer/60765

Google Support: still checking on this one, Allen

Me: that's irrational... why are calendars an exception?

Google Support: because it is a privilege of an account admin Allen.

Me: I get it Tedd... it's a lazy design choice

Google Support: Well I do apologize for the design Allen

Me: there's nothing special about calendars that should allow this vs how email is treated

Me: so we have reached a dead end?

Me: is there an escalation path? the only work around is an extra $10/month for a super admin that is not a regular user account

Google Support: let me check Allen, please give me a moment

Google Support: what I am going to do is to hand you over to one of my colleagues who can further assist you on this one, they are going to get in touch with you within 24 hours

We'll see what they return with.

Improve this answer
1
  • What was the outcome?
    – user187667
    Commented May 28, 2018 at 14:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.