one hour, once a quarter

The super admin guide established the horizon: six months of audit log for nearly everything, the same six months whether you pay for Business Starter or Enterprise Plus. It stopped there on purpose, because it was an argument rather than a routine.

This is the routine. It fits in an hour, you run it four times a year, and it needs no code.

First, two things Google will not sell you at your price, so you can stop looking for them.

the two doors that are closed

There is no scheduled export on a Business edition. The BigQuery export, the supported way to get your logs somewhere permanent on a schedule, is available on Enterprise Standard and Plus, Education Standard and Plus, Frontline Standard and Plus, and Enterprise Essentials Plus. Business Standard and Business Plus are not on that list, according to Google’s documentation. Neither is sharing logs into Google Cloud’s logging service, which has an almost identical edition list. Two of the supported editions are not Enterprise, so the wall is not exactly where people assume.

There is no no-code way to automate it. The Reports API is available to you and it is free, and it is code. If nobody at your company will write a script, your schedule is a person with a calendar reminder.

So this is a manual routine, run by a human, four times a year, producing files that sit in a folder. It is unglamorous, and it is the whole gap between having six months of logs and having a record.

A procedure that depends on somebody remembering is a weak recommendation. The alternative is to tell you which questions matter and then fall silent at the one point where the answer expires on a schedule. An hour with a calendar reminder is a real intervention even when it is inelegant, and at your size the elegant version costs more than the problem it solves.

one thing to turn on first, and it is free

Before the routine, ten minutes that make the quarterly export a backstop.

In the admin console, go to Rules and create an activity rule. Data source: admin log events. Condition: role assignment or admin privilege granted. Action: email notification to all super admins.

Activity rules are available on Business Starter, Standard and Plus. At your tier you get notifications only, with no automated action and a cap on conditions. That is fine, because what you want is an email when somebody becomes an admin.

That one rule answers the super admin question going forward: you will not have to reconstruct who was granted admin in March, because you will have been told in March.

the hour

Google moves admin console menus around from time to time. If a path below does not match what you see, search the console for “audit and investigation”.

Prep, once, fifteen minutes. Confirm you hold the audit and investigation privilege, or super admin. Then create a folder for the exports somewhere outside the system producing them: a different account, or a laptop folder that syncs nowhere. A log stored inside the tenant it describes is a second copy, and the tenant can lose both.

The admin log, fifteen minutes. Reporting, then audit and investigation, then admin log events. Set the date range to the last four months, which overlaps your previous export by a month, for a reason that comes up below. Choose columns: date, actor, event name, event description, IP, affected user. Export to Sheets or CSV.

That file answers who held admin and when it changed, and who created which account, permanently, for as long as you keep the file.

The user log, ten minutes. Same place, user log events, same range. Columns: date, actor, event, IP, login type. This is the one that shows whether a leaver’s access was really dead, which is the question a buyer or an acquirer asks during diligence.

The OAuth token log, ten minutes. Same place again. Columns: date, actor, event, application name, client ID, scopes. This is the standing record of which applications were granted what.

Drive, ten minutes, and filter hard. Drive log events, filtered to external sharing and link visibility changes only. A full Drive export at two hundred people is unusable and will hit the row cap. The filter is the whole point of this step.

File it, five minutes. One folder per quarter, named for the quarter. Do not build a pipeline and do not import it anywhere. Treat the file as evidence. That is a lower ambition than most people reach for, and it is the reason this still gets done in the fourth quarter.

the quarterly hour

1. admin logwho got admin, who created accounts
2. user logwas the leaver's access really dead
3. OAuth logwhich apps were granted what
4. Drive, filteredexternal sharing and link changes only

the two details that decide whether this works

Overlap your window, because the logs do not all arrive at the same speed. Admin, user, Drive, SAML and Gemini events appear within minutes. Calendar and Groups can take up to a couple of hours. The OAuth token log can take a few hours. Google publishes these lag times next to the retention periods.

So an export run at midnight on the last day of the quarter misses OAuth events from that day, permanently, because you will never go back for them. Overlapping the range by a month costs nothing and closes the gap.

Know the row cap, because it decides which steps you can run at all. Google caps exports from the console at 100,000 rows on most editions; the editions with the security investigation tool get a much larger limit for exports to Sheets. At two hundred people you will hit the cap on Drive and probably nowhere else, which is why the Drive step is filtered and the others are not.

what you get, and what you do not

You get a folder that answers, in three years, questions your live console will have forgotten in six months. That is the whole deliverable.

You do not get search. There is no cross-log query at your tier, and a CSV in a folder is something you open and read. Reconstructing who held admin on a given date still means replaying changes by hand from your file.

And exporting does not extend the six months for anything you failed to export. The window closes on schedule whether or not anybody was paying attention, which is the case for putting the reminder in the calendar today.

the weakness of this advice

It depends on a person remembering, and the failure is silent. You do not find out you skipped the second quarter until somebody asks a question in the fourth, and by then the answer is gone.

The only mitigation is unromantic: put the reminder in a shared calendar, name a second person on it, and treat a skipped quarter as something you write down, never something you quietly catch up on.

Somebody will ask whether they are obliged to keep this. Mostly, no. NIS2 binds medium and larger entities in specific sectors, and a SaaS company of your size is usually outside it unless you are a managed service provider, a cloud or data centre operator, an online marketplace or a trust service. Financial-sector rules bind financial entities and their critical suppliers. The accountability principle in European data protection law requires you to be able to demonstrate what you do, without setting a number of days for anything.

So this is less about compliance than about being able to answer a question instead of shrugging at it.

the calendar entry

Four dates a year. Ninety minutes blocked, because it will take sixty and you will want the margin. A named owner and a named deputy. The folder path in the invitation, so nobody has to remember where it goes.

That is the whole intervention. An incident you cannot reconstruct did not happen, as far as anyone can prove. These four calendar entries decide which of your incidents land on which side of that line.