Administrator alerts

As an administrator, you may already receive notifications for events that affect your domain, such as when users are approaching their storage limits or monthly bills are coming due.

You can also elect to receive alerts when other important events occur, such as potentially suspicious login attempts, or service setting changes by other administrators. Just choose the Predefined alerts you want to receive in the Reports section of your Admin console.

Account activity alerts do not apply to SSO domains.

There are two types of alerts described below; Predefined alerts, and Custom alerts.

Types of Predefined alerts

User alerts

You can receive User alerts when any of the following user account activities occur:

  • Suspicious login activity

    This is a successful or challenged login event identified by our risk analysis system as outside the normal pattern of user behavior. For example, this could be a user logging in from an unusual location or in a manner associated with abuse. If we detect that an unauthorized person is attempting to access a user's account, we will present them with a Login Challenge.

    Note: If a suspicious event occurs when a user is using Mail Fetcher to import mail from another Gmail account, a Google IP address is reported; this is because the messages are being fetched through our servers.
  • User’s password changed
  • User’s Admin privilege revoked
  • New user added
  • User suspended
  • Suspended user made active
  • User deleted
  • Apps outage alert

    Send email alerts to admins, users, and groups when Google posts a new outage message, an update to an existing outage, or a resolved message to an existing outage status message gets to the Google Apps Status Dashboard.

  • User granted Admin privilege

Settings alerts

You can receive Settings alerts when settings for any of the following applications or devices are changed in your Google Admin console (settings made by a Google administrator):

  • Mobile settings changed
  • Drive settings changed
  • Calendar settings changed
  • GMail settings changed

Email alerts

You can receive Email alerts when any of the following email delivery events occur:

Click the alert for a detailed description and debugging tips.

Note: Email alerts (and all Predefined alerts) are off by default. See the Choose your alerts section for information on how to turn Predefined alerts on.

Types of Custom alerts

You can create Custom alerts for any of the following audit stream types:

Refer to the links above to use the Filters section to create a Custom alert.

Note: All Custom alerts are on by default. See the next section, Choose your alerts, for information on how to turn your Custom alerts off.
Choose your alerts
  1. Sign in to the Google Admin console.
  2. Click Reports.
    Where is it?
  3. Click Manage Alerts in the left navigation pane to review the available notifications. The Custom alerts appear at the bottom. They are ON by default.
  4. Select each Predefined alert notification you want to receive by setting its Status switch to ON.
  5. (Optional) Configure Predefined alerts to be sent to additional recipients by clicking an alert's Email Recipients and entering additional email addresses. You can also toggle the SuperAdministrator selection for Predefined alerts on and off. You can edit your Custom alerts to change any of the attributes or you can delete the alert.
Respond to a suspicious login-activity alert
  1. Contact the users with suspicious logins, and ask them if they remember signing in when the suspicious login occurred. They can check their last account activity if they're unsure.
  2. If you can't establish the legitimacy of the login, follow the Google apps Admin Security Checklist. Pay special attention to administrator login activity.
  3. As a precaution, we encourage you to reset the password of any account that has suspicious activity.
  4. If you determine the suspicious activity is actually a legitimate login, but you keep getting alerts for this user, consider enrolling the user in 2-step verification, which will reduce inaccurate suspicious login notifications. We recommend enrolling all of your users in 2-step verification.
Due to the sensitive and potentially private nature of user activity logs, Google for Work Support cannot provide any additional investigation into alerts originating from suspicious login attempts.
Was this article helpful?