Skip to main content

Detecting Usage from Google Workspace Audit Logs

Updated
[Notice of UI Terminology Change]
With recent sequential updates, the term "Member" on the screen has been changed to "User." If you still see "Member" in some parts of this help documentation, please read it as "User." For more details on the background of this change, please refer to this announcement.

With Josys, you can automatically detect the actual usage of internal users by utilizing Google Workspace audit logs. Visualizing actual app usage helps identify inactive accounts and optimize license utilization. This page describes the Google Workspace audit logs.

Note: The screenshots in this article are currently taken from the Japanese version of the product. Some labels in the images may differ from the English interface.

Overview

With Josys, you can automatically detect the actual usage of internal users by utilizing Google Workspace audit logs.
Visualizing actual app usage helps identify inactive accounts and optimize license utilization.

This page describes the Google Workspace audit logs.

Reference: Detecting App Usage

💡 This feature is available for organizations integrated with "Google Workspace."
To retrieve audit logs, you must grant the necessary access permissions to Josys.

What You Can Do

  • Automatically detect apps actually used by users on Google Workspace
  • Optimize licenses by distinguishing between active and inactive users
  • Visualize SaaS services (e.g., Notion, Slack, ChatGPT, etc.) that users log into using their Google Workspace accounts

Eligible Customers

  • Available to all companies integrated with Google Workspace. *It is not required to set Google Workspace as the User Master.

💡This feature uses the permission to "View reports on G Suite domain management" granted when integrating Google Workspace with Josys.
*Since this is a permission that Josys newly started acquiring after December 2022, customers who integrated Google Workspace before that date will need to re-integrate.

Reference: Deleting/Re-integrating Integrated Apps

How to Check on the Google Admin Console

  1. Log in to the Google Admin Console.
  2. From the left menu, click "Reporting > Audit and investigation > OAuth log events".
  3. Click "Add a filter," select "Event," and apply with "Is," "Authorize."
  4. The information displayed here will be synced to Josys.

    Although the filter may default to dates like "1 week ago or later,"
    Josys will import data starting from one month prior to the date you integrated the app with Josys.

How to Check Detected Data

Please refer to this page for details.
Reference: Managing Detected Apps

FAQ

  • Q. When are the logs updated?
    A. They are updated early in the morning of every business day.
  • Q. I integrated/re-integrated Google Workspace, but nothing is displayed on the "Detected Apps" screen.
    A. Data is retrieved early in the morning of every business day, not at the exact moment of integration.
    Since the previous day's data is reflected on the current day, please wait until the business day after next for new integrations.
  • Q. The usage count seems low. Why is that?
    A. For access logs from Google Workspace, the usage count represents the number of times login authorization was granted to the destination app.
    (It does not necessarily represent the number of times Google Login was used.)
  • Q. I have multiple Google Workspace integrations. Do you retrieve audit logs from all integrated Google Workspace tenants?
    A. Yes, logs are retrieved from all integrated Google Workspace tenants.
  • Q. If there are multiple different tenants for the same application, can you distinguish and detect access for each? For example, what happens if our company uses two Asana tenants?
    A. The Google Workspace audit logs used for this feature only contain data on "who logged into what app and when via Google," so it is not possible to distinguish between different tenants. However, in many applications, it is impossible to create two accounts with the same email address. Therefore, if you know which tenant has the account with the same email address as the Google account, you can determine which tenant the detected user is accessing.
  • Q. The date and time shown in the last active date/time is different from when I actually last used it. Why?
    A. Please check if the content matches what is displayed when you filter by "Event: Authorize" in the OAuth logs on the Google Admin Console.

    "Event: Authorize" occurs when permission is granted to log into each SaaS tool using a Google account.
    For apps that require permission every time, "Event: Authorize" occurs every time, but for others, it does not. Therefore, the time of the first login often becomes the "last active date/time."
    If you want to retrieve the last active date/time in a more real-time manner, please consider installing the browser extension.
    Reference: About Browser Extensions

Related articles