Google Workspace Admins Need to Check Security Rules Before August Ends
If you administer Google Workspace and use its audit logs, security investigation tools, or custom alert rules, there is a deadline hiding at the end of this month that is worth putting on the calendar.
Google has been changing the names, types, reporting frequency, and conditions for a number of Admin log events. The old and new versions have been available side-by-side during the transition, but Google says that ends after August 2026. At that point, only the new event names and types will remain.
This is not an outage, and it does not affect somebody who simply uses Gmail, Drive, and Docs every day. It matters to the people responsible for watching what is happening inside a Workspace organization.
The biggest gotcha is saved investigations. Google says investigations built on the legacy events will stop working after August. Custom charts in the security investigation tool will still be based on the old data, and existing queries, alerts, reports, and rules may need to be changed.
Google is automatically migrating affected rules, which sounds reassuring until you get to the footnote. Some rules with more than one changed event condition can begin generating additional alerts unless an administrator updates them. Google’s example is a rule that was intended to alert on one specific Gmail setting change but, after migration, may alert on every Gmail setting change.
That is the sort of change that rarely earns a dramatic headline, but it is exactly how useful monitoring turns into either a blind spot or an alert firehose. Neither is especially helpful when you are trying to figure out whether something actually happened.
If your organization uses Workspace security investigations or custom rules, review Google’s migration table before August 31. Check saved investigations, queries, reports, and alerts that depend on Admin log events, then test any automatically migrated rules to make sure they still mean what you think they mean.
For a small business that has never built any of this, there is probably nothing to do. For an MSP, IT administrator, or business that has put real effort into Workspace monitoring, however, this is a very good time to make sure the dashboard will still be watching the right things in September.
