Using BigQuery logs to track Delegated Mailboxes

Track agent performance in delegated mailboxes without the “send on behalf of” permission

Tracking individual agent performance inside a Delegated Mailbox can be vital for understanding team performance and ensuring accountability.

Email Meter provides a simple solution for capturing detailed metrics about each agent’s actions in Delegated Mailboxes if the send on behalf of permission is enabled.

If you’d like to get agent performance metrics without turning on the Send on Behalf setting, the only alternative is enabling BigQuery logs for your Google Workspace domain, and giving access to Email Meter to those logs to capture that information.

You’ll need admin permissions in your Google Workspace domain or get in touch with your Google Workspace Admin to follow through with these instructions.

Requirements

• A supported Google Workspace edition:
  • Enterprise Standard or Plus
  • Education Standard or Plus
  • Frontline Standard
  • Enterprise Essentials Plus
• A Google Cloud Platform project with billing enabled
• BigQuery logs export configured for your domain
• Granting Email Meter access to those logs

Steps

Set up BigQuery

First, you’ll need to set up a BigQuery project to store your Google Workspace logs:

• Create or open a project in Google Cloud Console
• Add a Google Workspace admin account as Project Editor
• Grant the [e-mail] service account Editor access

For detailed instructions, follow Google’s documentation on setting up a BigQuery project for reporting logs.

Enable logs export

Then, you need to configure the export of Google Workspace logs to BigQuery:

• Sign in to the Google Admin console
• Go to Menu > Reporting > Data Integrations
• Enable Google Workspace data export to BigQuery
• Specify a dataset name where the logs will be stored (you’ll need this dataset name for the SQL query in the next section)

For detailed instructions, follow Google’s documentation on setting up service log exports.

Share access with Email Meter

After completing the previous steps, follow these instructions to securely share access with Email Meter:

Create a BigQuery Table Function

Create a separate dataset named emailmeter_auditlogs in your BigQuery project where you’ll create a table function. This dataset will be shared with Email Meter, keeping your main audit logs dataset private.

Run the following SQL code in BigQuery to create the table function:

CREATE OR REPLACE TABLE FUNCTION emailmeter_auditlogs.delegate_user_logs(d DATE, m ARRAY<STRING>)
AS (
  SELECT
    gmail.event_info.timestamp_usec,
    gmail.message_info.subject,
    gmail.message_info.source.address,
    gmail.message_info.rfc2822_message_id,
    gmail.event_info.client_context.session_context.delegate_user_email
  FROM `{project_id}.{logs_dataset_id}.activity`
  WHERE TIMESTAMP_TRUNC(_PARTITIONTIME, DAY) = TIMESTAMP(d)
    AND LOWER(gmail.message_info.source.address) IN UNNEST(m)
    AND gmail.event_info.client_context.session_context.delegate_user_email IS NOT NULL
    AND gmail.message_info.source.selector = "send"
    AND gmail.message_info.action_type = 2
);

Replace the placeholders with your actual values:

• {project_id}: your Google Cloud Project ID
• {logs_dataset_id}: the dataset name where your Google Workspace audit logs are being synced (configured in the “Enable logs export” step above)

The table function acts as a secure interface to your audit logs, allowing Email Meter to query specific data without accessing your entire audit logs dataset.

Authorize the routine

In your main audit logs dataset (the one where Google Workspace syncs the logs), you need to authorize the table function you just created:

1. Go to your audit logs dataset in BigQuery
2. Click on “Authorized routines” (or “Sharing” > “Authorized routines”)
3. Click “Add authorization” or “Authorize routine”
4. Select the project, dataset (emailmeter_auditlogs), and routine (delegate_user_logs) you created in the previous step
5. Click “Add authorization”

This allows the table function in the connection dataset to read from your private audit logs dataset.

Grant Email Meter access to the routine dataset

Finally, grant the Email Meter service account access to only the dataset containing the table function:

1. Go to the emailmeter_auditlogs dataset you created earlier
2. Click on “Sharing” > “Permissions”
3. Click “Add principal”
4. Add the Email Meter service account: [e-mail]
5. Assign the role: BigQuery Data Viewer
6. Click “Save”

This approach ensures Email Meter can only query through the authorized table function and cannot access your raw audit logs directly.

Contact your Business Intelligence Consultant

Once you’ve completed all the steps above, contact your Business Intelligence Consultant at Email Meter to verify the connection. You’ll need to provide them with:

• Your Google Cloud Project ID
• Your Dataset ID (which should be emailmeter_auditlogs based on the instructions)

We’ll notify you when the data is ready in your dashboard.

Frequently asked questions

Why do I need to enable billing in Google Cloud?

BigQuery requires billing to be enabled to store and process logs. However, you will only be billed for the queries you perform. You can always monitor your usage and adjust your queries to optimize costs according to your needs.

How long does it take for the data to appear in my dashboard?

Once everything is set up, logs are processed daily. This means that agent performance metrics will be available in your dashboard the day after the email activity occurred.

Isn't there another alternative to get these metrics?

No, BigQuery logs are the only way to get events performed by specific users inside delegated mailboxes when the “Send on Behalf” feature is disabled.