Google Graduated Takeout - Something went wrong. Try again.

Education editions of Google Workspace include a less know feature that allows staff and students to migrate their email, calendar, contacts and Docs/Drive data to another Google identity.

The destination identity can be a regular Google consumer account or a Workspace account. The latter has some caveats.

The target account must have;

• The Core Services (Apps) enabled for for the incoming data.
  i.e. Google Drive must be enabled for Google Docs to be migrated
• Additional Service enabled for for the incoming data.
• Additional Service without individual control enabled for for the incoming data*.
• Been Marked as 18year old older, either via OU or by group

*Additional Service without individual control is only applicable for accounts marked 18 years and older with Aged based access. See: https://support.google.com/a/answer/7646040

For Google Workspace for Education editions only: users under the age of 18 are restricted from using these services with their Google Workspace for Education accounts, even when this setting is On. For details, go to Control access to Google services by age. If one of these services later gets an ON/OFF control in the Admin console, it is set to Off for primary and secondary institutions.

Where a user tries to initiate the Graduated Takeout process, to migrate to a Workspace account, the Target (destination) account must me marked 18 or older, as Graduated Takeout will not operate without Additional Service without individual control.

Failure to mark the account as 18 or older will result in the non descript error Something went wrong. Try again.

References:

https://support.google.com/edu/classroom/answer/11081157
https://support.google.com/a/answer/10651918

We are sorry, but you do not have access to Please contact your organization administrator for access.

We are sorry, but you do not have access to <service Name>. Please contact  your organization administrator for access.

If you are a Google Workspace user and you see this message, it means your Google Workspace admin has turned off the a Google service for your account .

To resolve the issue, contact you Google Workspace admin or where you are the admin, please consult this article 

https://support.google.com/a/answer/182442?hl=en

Click a service name below for instructions (requires an administrator account).

Google Workspace	Additional Google Services	Google Workspace Marketplace Apps
Calendar Google Chat Cloud Search Directory Drive Gmail Currents Groups for Business Jamboard Keep Google Meet Google Voice Google Sites Classic Sites Tasks Classic Hangouts Vault	Blogger Brand Accounts Google Ads Google Analytics Google Cloud Google Domains Google Earth Google Maps Google My Maps Google Payments Google Photos Google Play Search and Assistant Search Console Web & App Activity YouTube Other...	Any Google Workspace Marketplace app

Google Vault: Are shared files discoverable?

Google Vault: Are off domain shared files discoverable in Vault?

Recently a question about Google Vault was put to me in the G Suite product forums where I contribute under Google's Product Experts Program.

We are setting up Google Vault for our organization. Using me as an example, say my wife, who not a part of our organization but who has a personal Google account, shares a Google Doc for a household grocery list with me at my work address. Are you saying that that document would be then searchable by Vault administrators, since it was shared to my work account? [link]

Normally Google's Help Center is the place to go for most answers, but I was unable to find an article that covers this specific question. This article goes close but does specifically talk about the drive content owned by an off domain user.

So how does Vault handle this?

Testing

Test #1: Discover shared Drive content by off domain owner.

1. Login as a consumer gmail account.
2. Create a Google Doc
3. Share it directly with a G Suite user in a domain with Vault enabled.
4. Login as G Suite user and confirm I can view the shared file.
5. Login in as an Admin to Vault and search for the Google Doc.

Test #1 Result: Files shared by off domain user (owned) are discoverable in Vault.

Test #2: Discover unshared content by off domain owner.

1. Login as a consumer gmail account.
2. unshare the above Google Doc
3. Login as G Suite user and confirm I cannot view the shared file.
4. Login in as an Admin to Vault and search for the Google Doc.

Test #2 Result: Files unshared by off domain user (owned) are no longer discoverable in Vault.

Test #3: Discover publicly shared Drive content by off domain owner.

1. Login as a consumer gmail account.
2. Create a Google Doc
3. Share it publicly (link).
4. Login as G Suite user and use the link to confirm I can view the shared file.
5. Login in as an Admin to Vault and search for the Google Doc.

Test #3 Result: Files shared publicly (by link) by an off domain user (owned) are not discoverable in Vault.

Test #4: Discover publicly shared Drive content by off domain owner and "Add to My Drive..."

1. Login as a consumer gmail account.
2. Create a Google Doc
3. Share it publicly (link).
4. Login as G Suite user and use the link to confirm I can view the shared file.
5. Add the Doc to "My Drive" via the "Add to My Drive..." Option
   
6. Login in as an Admin to Vault and search for the Google Doc.

Test #4 Result: Files shared publicly (by link) by an off domain user (owned) are discoverable in Vault, if the G Suite user adds the file to their Drive .

Test #5: Discover publicly unshared content by off domain owner after it's removed from My Drive.

1. Login as G Suite user, select the Doc and "Remove from my Drive".
2. Login in as an Admin to Vault and search for the Google Doc.

Test #5 Result: Files are not discoverable in Vault.

Summary

Key findings:

• Files owned by users outside the domain and shared directly with G Suite users are discoverable.
• Discovery is only possible while sharing remains enabled.
• If the owner revokes the sharing, discovery is no longer possible.
• Files publicly shared, must be added via "Add to My Drive" for discovery to work.
• Removing the file from "My Drive", will stop discovery.

Considerations:

1. Vault will not provide visibility to data leakage via files owned by off domain users.
   
   Potentially a malicious actor could establish a Google consumer account, create and share a file with an G Suite user. Then dump data into that file and unshare, without Vault showing a record of that.
   
2.  External parties sharing Drive files or Google Docs with G Suite users must be aware G Suite admins can access via Vault.