> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email/google-workspace-formerly-g-suite-remove-malicious-email.md).

# Google Workspace (Formerly G Suite): Remove Malicious Email

*This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [*Enable an Auto Remediation in Workbench*](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.*

## How It Works <a href="#h_01jgydp2j2h80jh6z0z91at9ne" id="h_01jgydp2j2h80jh6z0z91at9ne"></a>

If our SOC identifies an email that must be removed, Workbench completes the action automatically unless it is specifically called out as a "Never remove" asset (the inboxes must first be added as context and then configured in Workbench; see [Step 3](#h_01jgyc8wpyhctwv9qstbsatmnq)). Quarantine inboxes are often called out as "Never remove" assets.

## Step 1: Allow Appropriate Permissions <a href="#h_01jh5zgcgw8ekzjnfd2tzwjvat" id="h_01jh5zgcgw8ekzjnfd2tzwjvat"></a>

1. Make sure you assign all API permissions in the [Google Workspace (formerly G Suite) Setup for Workbench](/connect-your-technology/d-j-integrations/google/google-workspace-formerly-g-suite-setup-for-workbench.md) guide.
2. From the same project you created during onboarding for Google Workspace, search for **Gmail API** and select it.<br>

   <div align="left"><figure><img src="/files/LeJTov46cTQcGl2Liibv" alt="Gmail API search result in the Google Workplace Marketplace." width="375"><figcaption></figcaption></figure></div>
3. Enable the Gmail API permissions for the project by selecting **Enable**.
4. In the Google Workspace admin console, navigate to **Domain-wide Delegation**: <https://admin.google.com/ac/owl/domainwidedelegation>.
5. Locate the API Client created for the Service Account during onboarding, and then select **Edit.**

   <div align="left"><figure><img src="/files/wRYPBEsMefI9GnLUzB5t" alt="API client list shows the service account." width="563"><figcaption></figcaption></figure></div>
6. Add the following OAuth scope:&#x20;
   * <https://www.googleapis.com/auth/gmail.modify>

     <div align="left"><figure><img src="/files/XLGFHNnmL1zVIBlAeWlt" alt="The OAuth scope is added to the Edit scopes list." width="236"><figcaption></figcaption></figure></div>
7. Select **AUTHORIZE**.

## Step 2: Enable Google Workspace Logs in BigQuery <a href="#id-01fy4r4gfznfkpqtqkz176kq02" id="id-01fy4r4gfznfkpqtqkz176kq02"></a>

1. Confirm you are signed in to the [Google Admin console](https://admin.google.com/) with a **super administrator account**. *You cannot complete these steps without super admin permissions.*
2. Navigate to **Reporting > Data integrations**.
3. Choose the **BigQuery Export** card and select **Edit**.
4. To activate BigQuery logs, select the **Enable Google Workspace data export to Google BigQuery** checkbox.
   1. Under BigQuery project ID, select the project created for the Google Workspace integration.
   2. Under New dataset within the project, enter `gmail_logs_dataset` as the name for the new BigQuery dataset. *If you require a custom dataset name, please* [*reach out to Expel Support*](/support/how-to-reach-us.md) *for assistance. Providing the custom name allows us to properly configure this feature.*
5. Select **Save**.
6. In the same project for the Google Workspace integration, navigate to the **IAM & Admin** console. Find the [previously created service account](/connect-your-technology/d-j-integrations/google/google-workspace-formerly-g-suite-setup-for-workbench.md), select the **pencil icon**, and then add the role **BigQuery Job User** to the service account.

   <div align="left"><figure><img src="/files/r6RxJEDoMEbbKJlw9zk4" alt="IAM and Admin Permissions list shows the service account." width="563"><figcaption></figcaption></figure></div>
7. Search for and add BigQuery Job User, and then select **Save**.

   <div align="left"><figure><img src="/files/y8X0uhaknFf2EIc34TpE" alt="BigQuery Job User role is selected on the Edit permissions screen." width="279"><figcaption></figcaption></figure></div>
8. In the Google Cloud console, navigate to BigQuery: <https://console.cloud.google.com/bigquery>
9. Find the **gmail\_logs\_dataset** created in [Step 2](#id-01fy4r4gfznfkpqtqkz176kq02).
10. Open the dropdown menu using the three dots on the right, and then select **Open**.

    <div align="left"><figure><img src="/files/dAxhBzFP3i9QzXTPUusL" alt="" width="256"><figcaption></figcaption></figure></div>
11. On the Dataset info screen, select **EDIT DETAILS** in the top right.

    <div align="left"><figure><img src="/files/hma4OqBqSeHbpvCccmbV" alt="gmail_logs_dataset info details page." width="375"><figcaption></figcaption></figure></div>
12. Select **Enable table expiration**. Enter the length of time to retain the log tables, and then select **SAVE**. *Default retention is set to 60 days, but we recommend **30 days**.*

    <div align="left"><figure><img src="/files/k8y4VHmpsFPMIkTbefOg" alt="Enable table expiration box is checked and 30 is entered into the Default maximum table age field." width="188"><figcaption></figcaption></figure></div>
13. Select **SHARING >** **Permissions.**

    <div align="left"><figure><img src="/files/9J8Nq7Yd3YY2MXquBywn" alt="gmail_logs_dataset info details screen with Permissions selected." width="375"><figcaption></figcaption></figure></div>
14. Select **Add principal**.
15. Under New principals, add the service account, and then select the role **BigQuery Data Viewer**.

    <div align="left"><figure><img src="/files/SRfzy9d44aQbIHXmK4Hp" alt="The service account and BigQuery Data Viewer role are added." width="375"><figcaption></figcaption></figure></div>
16. Select **SAVE**.

## Step 3: Update Your Context <a href="#h_01jgyc8wpyhctwv9qstbsatmnq" id="h_01jgyc8wpyhctwv9qstbsatmnq"></a>

**If you do not want to specify any inboxes for a "do not remove" list, skip to** [**Step 4**](#h_01jgycgywj4m9tc7j443dvsmf1)**. Quarantine inboxes are often called out as "Never remove" assets.**

Working with your Customer Success Manager (CSM), add any inboxes that should be on the "do not remove" list as [org context](/workbench-reference/expel-terminology.md#org-context) for your environment. You will then be able to select those inboxes as "Never remove" assets when you enable the auto remediation in Workbench.&#x20;

{% hint style="info" %}
If our SOC identifies an email that must be removed, any emails from inboxes added as "Never remove" assets are assigned to you as actions rather than being removed automatically.
{% endhint %}

## Step 4: Return to the Main Setup Guide <a href="#h_01jgycgywj4m9tc7j443dvsmf1" id="h_01jgycgywj4m9tc7j443dvsmf1"></a>

Your Google Workspace device is now ready for the Remove Malicious Email auto remediation. You should now do one of the following:

* **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process.
* **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email/google-workspace-formerly-g-suite-remove-malicious-email.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.