A super administrator may export and preserve Workspace data offline as part of organizational disaster recovery planning efforts
Google Workspace offers several ways to preserve sensitive or important data via Google Vault, backup options and Google Takeout: Vault allows an administrator to preserve and retrieve information selectively, as specified by legal requirements or data loss prevention procedures; third-party cloud backup options ensure employees or administrators can recover accidentally deleted data long after a 30-day stay of a file or email in trash has passed; Takeout allows individuals to export items with the permission of an administrator.
Google also allows a super administrator to export and download all of your organization’s Google Workspace data. Due to storage, bandwidth and security limitations, this isn’t something a super administrator will be likely to do often. However, periodic export and secure offline preservation of Workspace files and email may be prudent as part of your organization’s disaster mitigation and recovery practices.
To export your organization’s Google Workspace data, first review the requirements listed below, then follow the steps to initiate an export as described.
Prerequisites for Google Workspace organizational data export
Google Workspace Data export is the enterprise equivalent of the Google Takeout system: The former exports all Workspace data, while the latter exports data for an individual account. Since such a comprehensive data export can cause significant security concerns, Google places several limitations on the process.
First, only a Google Workspace super administrator account may initiate an export. While many administrator accounts may have authorization to administer routine tasks — such as managing groups, users or access to certain services — you’ll need to have a Google Workspace super administrator account in order to initiate a data export for an organization.
Second, you must have two-step verification enabled for your super administrator account. Typically, administrators rely on an authenticator app (e.g., Google Authenticator) for this added step. However, for enhanced security, I suggest that super administrator accounts be configured to require a physical security key. The added cost and diligence necessary to carry a key is appropriate for people with super administrator access in Google Workspace.
SEE: Will Google’s Titan security keys revolutionize account security? (TechRepublic)
Third, Google Cloud must be enabled for your Workspace account. If necessary, go to the Admin Console | Apps | Additional Google services | Google Cloud Platform, and then select it. At a minimum, the service must be enabled for the super administrator account you plan to use to initiate the data export.
Fourth, be aware that Google places restrictions on data exports, both by time and by the number of Workspace accounts. Recently created Workspace accounts will not be eligible to export data: Your Workspace account must have been active for more than 30 days. Similarly, organizations with more than 1,000 users must contact Google support services to request temporary access to the data export tool. You may only initiate a data export once every 30 days.
How to export Google Workspace data
Once all of the above requirements have been met, a Workspace super administrator may start the data export process.
- Sign in to the Admin Console.
- Go to the Data Export page.
- Review the details. When ready, select the Start Export button, as shown in Figure A. If you use Enterprise Plus, Education Standard or Education Plus editions, you may be able to select a specific organizational unit or group for whom to export content.
Figure A
- Once the request is received, the page displays a confirmation of the export request, as shown in Figure B.
Figure B
- For security purposes, the system places a notice of the export request on the main Admin Console, as shown in Figure C.
Figure C
- The system will alert other Workspace administrators of the action via email, as shown in Figure D.
Figure D
- The super administrator will receive an email after the export archive has been created.
- At this point, the super administrator may download the data. The Google Cloud Platform bucket access allows you to select either the full folder, as shown in Figure E. Alternatively, you may open this folder and select individual subfolders to download. Make sure to download it to a device with sufficient storage space, since it may be of considerable size.
Figure E
More importantly, once downloaded, secure your organizational data with commensurate care. Ideally, you will keep your data in an access controlled, monitored and secured location. In many cases, you may want to store the data on a device not connected to a network.
For business continuity purposes, you may repeat the above export process as frequently as is appropriate for your disaster mitigation needs. Some super administrators may wish to export data as often as possible (i.e., every 30 days), while many may prefer to export data only annually.
What’s your experience with data export?
As a policy, how often do you export and save your organization’s Google Workspace data? Is this practice part of your disaster mitigation and recovery policies? Once exported, to what sort of system do you save and store the data? Is this system kept at a standard office site or do you move your archived data to a secured secondary location? Mention or message me on Mastodon (@awolber) to let me know your organizational practices to preserve Workspace data.