{"id":516441,"date":"2022-10-20T08:40:42","date_gmt":"2022-10-20T06:40:42","guid":{"rendered":"https:\/\/www.devoteam.com\/expert-view\/what-is-google-apps-manager-gam\/"},"modified":"2025-05-14T16:11:27","modified_gmt":"2025-05-14T14:11:27","slug":"what-is-google-apps-manager-gam","status":"publish","type":"expert-view","link":"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/","title":{"rendered":"What is Google Apps Manager (GAM)? Our experience in deploying GAM in a secure way"},"content":{"rendered":"\n

This article is written by Brecht Sannen, Solution Engineer Google Workspace at Devoteam G Cloud Belgium<\/em><\/p>\n\n\n\n

Letting Loose Google Apps Manager (GAM) in a secure way<\/h2>\n\n\n\n

Have you heard of GAM? It is a very powerful tool that allows you to govern your Google Workspace environment through a command line. Companies use GAM for actions ranging from creating users to administrating mail delegations. But with great power comes great responsibility and the goal of this blogpost is to share our experience in deploying GAM in a secure way. <\/strong><\/p>\n\n\n\n

What is GAM and what can you use it for?<\/h2>\n\n\n\n

GAM, short for Google Apps Manager,<\/a> is an API wrapper for Google Workspace api\u2019s developed by Jay0lee<\/a>. It wraps the api calls in commands so that the api\u2019s become more easy to use.This, in turn, is the reason why it is so widely used when it comes to executing administrative tasks. It even gets referenced on google support<\/a> nowadays! At Devoteam Gcloud we mainly use this tool for actions such as list all shared drives, list all files that are shared externally, list all mail delegations, list all groups and their settings\u2026 <\/p>\n\n\n\n

There are multiple versions of GAM and we usually recommend to use the advanced GAMADV-XTD3<\/a> developed by Ross Scroggs<\/a> as it comes with some additional features that might be needed to execute certain actions (e.g. Modify the GAL, deploy multi domain GAM,…) There is a google site<\/a> about GAMADV-XTD3 that is extremely valuable when it comes to creating a script that works for you. <\/p>\n\n\n\n

Risks when using GAM<\/h2>\n\n\n\n

The main risk when you are using GAM is that you need a service account and an accompanying  json token to make the necessary API calls to your google workspace domain. When you create said token, this token is valid until you remove it in your GCP project. So keep your tokens somewhere secure!<\/p>\n\n\n\n

Furthermore, when a call is made on behalf of a user in your domain, you cannot see that the call was made with a tool like GAM. In the audit log you will see the action you made with GAM as if the user performed said action themselves. This is why it is paramount that you know exactly who is using GAM and why. <\/p>\n\n\n\n

Secure ways to deploy & use GAM<\/h2>\n\n\n\n

When it comes to deploying GAM in a secure way, we recommend 2 methods : <\/p>\n\n\n\n

Run GAM on a dedicated Virtual Machine<\/strong><\/h3>\n\n\n\n

Running GAM on a dedicated VM is one way to make sure it is only accessible by the relevant parties. If you have a GCDS (Google Cloud Directory Sync) in your environment then you can run the GAM instance on that Microsoft server. You can also set up a dedicated Linux VM to run GAM. The upside of working this way is that you can set the device to a static IP. This means that in the audit log, based on that specific static IP, you know the calls are coming from that GAM instance.<\/p>\n\n\n\n

Downside with this way of working is that you need secure access to this device. If you access it through RDP, you might want to consider limiting certain IP\u2019s from being able to connect with your server. If you access it through SSH, think about limiting the network access to the device or setting up a strong password. All in all the catch is that you are managing yet another machine for another application. <\/p>\n\n\n\n

All paranoia aside but when you run GAM on a shared VM, it might be possible that somebody took the Oauth key and used it somewhere else! That is why it is important to rotate your service account keys to make sure you revoke access to old keys. You do this by scheduling the command \u201cgam rotate sakey<\/a>\u201d every , let\u2019s say,  6-12 hours.  <\/p>\n\n\n\n

Run GAM on cloudshell<\/strong><\/h3>\n\n\n\n

You can put your GAM instance on Google Cloud Platform with Cloudshell. Cloudshell<\/a> is an online terminal that helps you manage your infrastructure. Running GAM on cloudshell is a preferred solution as with this way of working you can assure that the GAM instance is locked behind your Google account and no extra machine patching or securing needs to happen. <\/p>\n\n\n\n

With using GAM in the cloudshell, you can keep your GAM instance just behind your google account. No additional infrastructure needed. For more information on how to install GAMADV-XTD3 on cloudshell, please check out this link<\/a>.<\/p>\n\n\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Have you heard of GAM? It is a powerful tool that allows you to govern your Google Workspace environment through a command line. This blog shares Devoteam’s experience in deploying GAM in a secure way.<\/p>\n","protected":false},"featured_media":314283,"template":"","categories":[907],"tags":[1674,4424,1833,2301],"industry":[],"class_list":["post-516441","expert-view","type-expert-view","status-publish","has-post-thumbnail","hentry","category-google-cloud","tag-digital-workplace-lu","tag-google-apps-manager-lu","tag-google-cloud-lu","tag-google-workspace-lu"],"acf":[],"cards":"\n\t

\n\n\t\t
\"What<\/a><\/figure>\n\n\t\t\n\t\t
\n\t

Expert View<\/p>\n\n\t\t\n\t\t

What is Google Apps Manager (GAM)? Our experience in deploying GAM in a secure way<\/a><\/h3><\/div>\n\t\t\n\t<\/div>\n\n","yoast_head":"\nWhat is Google Apps Manager (GAM)? Our experience in deploying GAM in a secure way | Devoteam<\/title>\n<meta name=\"description\" content=\"GAM is a powerful tool that allows you to govern your Google Workspace environment through a command line. Read Devoteam's experience in deploying GAM in a secure way.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is Google Apps Manager (GAM)? Our experience in deploying GAM in a secure way\" \/>\n<meta property=\"og:description\" content=\"GAM is a powerful tool that allows you to govern your Google Workspace environment through a command line. Read Devoteam's experience in deploying GAM in a secure way.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/\" \/>\n<meta property=\"og:site_name\" content=\"Devoteam\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-14T14:11:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/what-is-google-apps-manager-gam\\\/\",\"url\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/what-is-google-apps-manager-gam\\\/\",\"name\":\"What is Google Apps Manager (GAM)? Our experience in deploying GAM in a secure way | Devoteam\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/what-is-google-apps-manager-gam\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/what-is-google-apps-manager-gam\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/devoteam.info\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/GAM-GoogleAppsManager-scaled-1.jpg\",\"datePublished\":\"2022-10-20T06:40:42+00:00\",\"dateModified\":\"2025-05-14T14:11:27+00:00\",\"description\":\"GAM is a powerful tool that allows you to govern your Google Workspace environment through a command line. Read Devoteam's experience in deploying GAM in a secure way.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/what-is-google-apps-manager-gam\\\/#breadcrumb\"},\"inLanguage\":\"en-LU\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/what-is-google-apps-manager-gam\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-LU\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/what-is-google-apps-manager-gam\\\/#primaryimage\",\"url\":\"https:\\\/\\\/devoteam.info\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/GAM-GoogleAppsManager-scaled-1.jpg\",\"contentUrl\":\"https:\\\/\\\/devoteam.info\\\/wp-content\\\/uploads\\\/2024\\\/12\\\/GAM-GoogleAppsManager-scaled-1.jpg\",\"width\":2560,\"height\":1707},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/what-is-google-apps-manager-gam\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Expert View\",\"item\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/expert-view\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"What is Google Apps Manager (GAM)? Our experience in deploying GAM in a secure way\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/#website\",\"url\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/\",\"name\":\"Devoteam\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/devoteam.info\\\/lu\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-LU\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"What is Google Apps Manager (GAM)? Our experience in deploying GAM in a secure way | Devoteam","description":"GAM is a powerful tool that allows you to govern your Google Workspace environment through a command line. Read Devoteam's experience in deploying GAM in a secure way.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/","og_locale":"en_US","og_type":"article","og_title":"What is Google Apps Manager (GAM)? Our experience in deploying GAM in a secure way","og_description":"GAM is a powerful tool that allows you to govern your Google Workspace environment through a command line. Read Devoteam's experience in deploying GAM in a secure way.","og_url":"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/","og_site_name":"Devoteam","article_modified_time":"2025-05-14T14:11:27+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/","url":"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/","name":"What is Google Apps Manager (GAM)? Our experience in deploying GAM in a secure way | Devoteam","isPartOf":{"@id":"https:\/\/devoteam.info\/lu\/#website"},"primaryImageOfPage":{"@id":"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/#primaryimage"},"image":{"@id":"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/#primaryimage"},"thumbnailUrl":"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1.jpg","datePublished":"2022-10-20T06:40:42+00:00","dateModified":"2025-05-14T14:11:27+00:00","description":"GAM is a powerful tool that allows you to govern your Google Workspace environment through a command line. Read Devoteam's experience in deploying GAM in a secure way.","breadcrumb":{"@id":"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/#breadcrumb"},"inLanguage":"en-LU","potentialAction":[{"@type":"ReadAction","target":["https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/"]}]},{"@type":"ImageObject","inLanguage":"en-LU","@id":"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/#primaryimage","url":"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1.jpg","contentUrl":"https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1.jpg","width":2560,"height":1707},{"@type":"BreadcrumbList","@id":"https:\/\/devoteam.info\/lu\/expert-view\/what-is-google-apps-manager-gam\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/devoteam.info\/lu\/"},{"@type":"ListItem","position":2,"name":"Expert View","item":"https:\/\/devoteam.info\/lu\/expert-view\/"},{"@type":"ListItem","position":3,"name":"What is Google Apps Manager (GAM)? Our experience in deploying GAM in a secure way"}]},{"@type":"WebSite","@id":"https:\/\/devoteam.info\/lu\/#website","url":"https:\/\/devoteam.info\/lu\/","name":"Devoteam","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/devoteam.info\/lu\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-LU"}]}},"uagb_featured_image_src":{"full":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1.jpg",2560,1707,false],"thumbnail":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1-150x150.jpg",150,150,true],"medium":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1-300x200.jpg",300,200,true],"medium_large":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1-768x512.jpg",768,512,true],"large":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1-1024x683.jpg",1024,683,true],"1536x1536":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1-1536x1024.jpg",1536,1024,true],"2048x2048":["https:\/\/devoteam.info\/wp-content\/uploads\/2024\/12\/GAM-GoogleAppsManager-scaled-1-2048x1366.jpg",2048,1366,true]},"uagb_author_info":{"display_name":"be.eleonore","author_link":"https:\/\/devoteam.info\/lu\/author\/"},"uagb_comment_info":0,"uagb_excerpt":"Have you heard of GAM? It is a powerful tool that allows you to govern your Google Workspace environment through a command line. This blog shares Devoteam's experience in deploying GAM in a secure way.","_links":{"self":[{"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/expert-view\/516441","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/expert-view"}],"about":[{"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/types\/expert-view"}],"version-history":[{"count":0,"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/expert-view\/516441\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/media\/314283"}],"wp:attachment":[{"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/media?parent=516441"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/categories?post=516441"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/tags?post=516441"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/devoteam.info\/lu\/wp-json\/wp\/v2\/industry?post=516441"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}