📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Google Workspace Activity Search

Search sign-ins, admin changes and Drive activity across your Google Workspace in one place.

Where to find it
Google Workspace › GW Activity Search
Who can use it
Anyone who can see the page
Plan
Cloud (Microsoft 365 / Google Workspace) monitoring
For
Everyone

What the page is for

When you investigate a Google Workspace account, the evidence is spread across sign-ins, admin console changes and Drive activity. This page searches all three at once and shows the results in time order, so you can follow what a person did from sign-in to file access.

Each result shows the time, the type of activity, the user, the event, its target or detail, and the IP address with its country, city and internet provider. Events flagged as suspicious or involving outsiders are marked with a warning icon.

The most recent activity loads automatically when you open the page.

What you see

The Google Workspace Activity Search page, with the activity search header, filters, results table and paging numbered 1 to 4.
The Google Workspace Activity Search page. Numbers match the list below.
  1. Activity Search header: with Export.
  2. Filters: Search (user, target, or event), Activity (Login, Admin, Drive), Period, Country, Suspicious and the search button.
  3. Results table: Time (UTC), Type, User, Event, Target / Detail, IP, Country, City and ISP.
  4. Paging: Jump to date, first page, Prev, the page number, Next and rows per page (50, 100 or 200).

How to investigate one user

  1. Type part of the person's address in Search, for example jane@.
  2. Leave Login, Admin and Drive ticked to see everything.
  3. Choose a Period: last 24 hours, 7, 30, 90 or 180 days.
  4. Click the search button or press Enter.
  5. Read the results from newest to oldest. Look for sign-ins from unexpected countries followed by admin or Drive activity.

How to find suspicious sign-ins

  1. Tick only Login under Activity.
  2. Tick Suspicious.
  3. Optionally enter a two-letter Country code, for example US, to see sign-ins from one country.
  4. Run the search.

How to find a specific event or file

  1. Type an event name or a file name in Search.
  2. Tick Admin for admin console changes, or Drive for file activity.
  3. Use Jump to date to go to a particular day. Click the ✕ beside it to return to the most recent activity.

How to export results

  1. Run your search.
  2. Click Export to download the current page of results as a CSV file.

Tips

  • Times on this page are in UTC.
  • The Country box suggests countries already seen in your results.
  • A red warning icon beside an event means it was flagged as suspicious or external.
  • Increase rows per page to 200 before exporting to capture more at once.

Troubleshooting

  • "No matching activity." Widen the Period, tick all activity types, or clear Country and Suspicious.
  • "No matching activity on or before <date>." The jump-to date is limiting results. Clear it to see the most recent activity.
  • No results at all. Check that Google Workspace is connected on the Google Workspace dashboard.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on.

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.