> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/more-features/expel-managed-phishing/setup-guides/enable-gmail-logs-in-bigquery.md).

# Enable Gmail Logs in BigQuery

{% hint style="warning" %}
Due to a change by Google, Workbench is no longer able to search for related emails across Google Workspace inboxes in bulk. We are actively working on a workaround and will update this guide as soon as possible. In the interim, please reach out to Google to request they reinstate the export functionality for emails from BiqQuery.
{% endhint %}

The following procedure guides you through enabling logs for Gmail in BigQuery to make the most use of Expel Managed Phishing. For example, you can then run an [Investigative Action](/workbench-reference/expel-terminology.md#investigative-action) that identifies recipients of malicious emails.&#x20;

1. Sign in to the [Google Admin Console](https://admin.google.com/).
2. Navigate to **Apps > Google > Workspace > Gmail​ > Setup > Email Logs in BigQuery**.
3. Select the **Enable** checkbox and enter a **Description**, such as "Gmail logs".
4. Select the ‌**project** to which the service account belongs.
5. Enter "gmail\_logs\_dataset" as the name for the new BigQuery dataset and select **SAVE**.
6. From the IAM console in the project where the service account was created, select the **pencil** icon, then search for and add the **BigQuery Job User** role to the service account.

<figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2FuqQC4IEVqKlUF8BsKQYc%2Fmceclip8.png?alt=media&amp;token=a4e527b2-c50c-4d3b-a715-a543ee49fbe0" alt=""><figcaption></figcaption></figure>

7. Select **SAVE**.
8. Navigate to [BigQuery in the Google Cloud console](https://console.cloud.google.com/bigquery).
9. Find the `gmail_logs_dataset`, then open the menu on the right and select **Open**.

<div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2FxhLMITdwtysMFLuVBUtu%2Fmceclip2.png?alt=media&amp;token=5eff7b1f-2f03-4ead-82c4-c1c2c0df1b50" alt="" width="375"><figcaption></figcaption></figure></div>

10. From the dataset details, select **EDIT DETAILS**.
11. Change the **Default maximum table age** to **30 days** (Expel's recommendation).
12. Select **SAVE**.
13. Select **SHARING > Permissions**.

<div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2Fo3zXoZaJlQAIaxWhrEJh%2Fmceclip4.png?alt=media&amp;token=05384198-4076-4d9b-b6cb-3375724f0249" alt="" width="563"><figcaption></figcaption></figure></div>

14. Under **New principals**, add the service account.
15. Select the `BigQuery Data Viewer` role.
16. Select **SAVE** to close the panel.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.expel.io/more-features/expel-managed-phishing/setup-guides/enable-gmail-logs-in-bigquery.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
