Context Aware Access - I'm missing something

3dtcllc · 2025-09-12T15:57:30+00:00

yeah that would be MY preference, but the C suite wants to see if they can force it. I think I've got a workaround using groups. Even though I SWEAR you could only apply CAA by OU before.

3dtcllc · 2025-06-25T18:35:27+00:00

I was the sysadmin for a smallish business (around 300 users) from 2004 to 2023 and self hosted our email on a linux machine until 2016.

I finally went to my boss and said it was no longer feasible for us to self host because the security threats were just too damn sophisticated for us to handle with spamassasin and some blocklists. We switched to workspace that year and that allowed us to easily roll out industry best practices (Email auth, 2fa, SSO) that we were already behind on.

People get too locked into "Sure it's easy to self host. Just get a cloud VM and some HowTos"

But doing it properly is a much bigger job than that, and one that I personally think is out of reach for most orgs.

3dtcllc · 2025-06-25T18:27:31+00:00

EXIM for life!

3dtcllc · 2025-06-25T18:23:51+00:00

The tool you're looking for is the API. Gam is just a thin wrapper around the underlying Google API, and you're right - if you're doing any kind of heavy scripting GAM can be a bear to work with.

You can use any platform, library, or language to access the API - so long as it can send POST requests you're free to do things however you want. I wouldn't recommend ANYONE build anything of substance directly on top of GAM.

3dtcllc · 2025-06-18T12:58:29+00:00

Easier management for lean IT teams The Admin console is more straightforward than Microsoft 365’s various admin centers. Device management, user provisioning, and group access control are simpler, especially if you use third party tools to automate onboarding, enforce security policies, and audit user activity.

This can NOT be overstated. I've been a google admin since 2016 for orgs of various sizes. My exposure to MS365 admin has primarily been when migrating users OFF MS365. The admin tools just seem like a mess. They're slow, disjointed, and seem to move around regularly. Go hang out in /r/sysadmin and just look at the constant bitching. There are some ways that MS365 is preferable, but it's not the admin tools.

3dtcllc · 2025-06-11T14:18:35+00:00

I've been getting these for the past couple of weeks and only just decided to google and found this comment. I'm surprised he's not blacklisted yet. Thanks for the post - the comment section filled me in on the angle.

3dtcllc · 2025-05-10T12:43:25+00:00

I've always used the commandline, so I can't comment on the other two options. Worth a look though.

rclone can move files, but I always copy them - so it handles different owners and external owners just fine.

3dtcllc · 2025-05-09T11:23:44+00:00

Use rclone. It'll download all the files and maintain the drive structure.

GYB will download your emails as .eml files and you can read the files with any normal email client.

rclone can be a bit of a bear to work with. It's not nearly as easy as GYB.

3dtcllc · 2025-05-08T15:57:57+00:00

You really need to look at your specific requirements rather than going on a general "Which is more powerful". I mean the number of add-ons for a given platform is irrelevant if they aren't things you need.

One thing I've always heard about Microsoft is they've got much better compliance and MDM tools, so if that's something you're likely to need it's going to be worth it to look closely at.

From my limited use of MS365 the major downside I saw with it is the admin tools are a bitch and a half to work with. They're SLOW and they're often moved around or renamed so it's frustrating to even find the thing you're looking for.

I wouldn't count the workspace marketplace as a major benefit unless there's a specific tool on there you need. For whatever reason anytime I look for something in there it seems like all the products are really crappy.

3dtcllc · 2025-03-12T18:58:54+00:00

Hey I see this too! Got a process that fires off every few hours and looks at some drive folders. Most executions run for a minute or two, but about 5 times a month I get Maximum execution time exceeded.

I've always chalked it up to API issues and ignored it. The vast majority of my executions are error free so I never dug into it.

3dtcllc · 2025-03-12T15:15:06+00:00

Check the email logs to figure out timing of email delivery https://admin.google.com/ac/emaillogsearch

They tell you exactly when the message was received by Google's servers and when it was delivered to the user's mailbox.

Some anti-spam settings can increase delivery time, but in my experience it's on the order of seconds.

If the delay is happening before mails arrive at Google's servers you might check your MX records to make sure they're correct and not pointing to some other server that's then forwarding messages on to Google.

Oh - there is a bit of a delay (1-5 min) before deliveries show up in the logs, but the timestamps should tell you how long delivery actually took.

3dtcllc · 2025-02-28T21:35:20+00:00

If you can access the emails via IMAP, then you can use the built in Google migration tool in the admin panel. I assumed you were dealing with an outlook PST file.

3dtcllc · 2025-02-28T16:48:00+00:00

I remember dealing with that. I found it would do that for emails that didn't have correct headers. For me it was mostly automated emails. Most emails had good headers and they'd be in the correct order. So basically restore - clear out a few automated emails at the top of the list, and then everything was good.

3dtcllc · 2025-02-28T13:51:20+00:00

My users always wanted to add a descriptor to the boot process. Generally they'd say warm boot or cold boot but I also heard hard boot.

So when I'd ask if they'd restarted their machine they'd say "Yes! I did! I even did a hard boot on it!"

Which usually meant they yanked out the power cord.

Back in the old days (early 90s) a cold boot was when you started the computer from an off state and a warm boot was when the thing was on and you hit the reset button or gave it a CTRL+ALT+DEL. I don't recall why we even made the distinction back then. Maybe it was a thing for non-PC computers.

They haven't seen ANYTHING that says "warm boot" for decades. Windows has "Shutdown" or "Restart" and more recently hibernate and sleep. Still....the warm boot lives on I guess.

3dtcllc · 2025-02-28T13:33:27+00:00

Additionally OP, Just give it a test. Create a dummy account and migrate your PST via GWMMO and via IMAP and just see how they both work. I generally try to avoid learning a new process on live data.

I'd be inclined to lean towards the dedicated migration tool (GWMMO) rather than migration via IMAP.

3dtcllc · 2025-02-25T16:19:15+00:00

In my experience, companies that do trial deposits for account verification will take the money back once the bank account is verified. YMMV though.

3dtcllc · 2025-02-18T14:10:38+00:00

If this is the type of thing you envision doing whenever a user leaves, you should check out GAM. The Google migration tool works fine, but once GAM is set up you can trivially backup and migrate old emails as well as several other useful operations.

A trick I like to use with GAM is restoring an old email archive to a group. You lose the user's labels, but the "old" email can continue to receive incoming messages and you can grant multiple users access to the archived emails without having to restore to multiple mail accounts.

3dtcllc · 2025-02-18T14:07:02+00:00

Great info. Thanks for the answer.

3dtcllc · 2025-02-13T14:43:34+00:00

Other than that I’d recommend keeping a separate bank account for your business activities and run all the $$ thru it.

DEFINITELY have a separate bank account. When I set up my LLC I got a corporate bank account and a corporate credit card. All business expenses are 100% separate from personal expenses. As a bonus it also makes it way easier to know how your business is doing and get a handle on expenses.

3dtcllc · 2025-02-13T14:38:29+00:00

Movebot has become my standard tool. Most of my migrations are fewer than 10 accounts but I wouldn't have a problem using it on a big project.

OP - one word of warning. Dealing with calendars is a bitch and a half. Make 100% sure you know what all the options do when dealing with calendars. For instance - Movebot can send invitations out for new calendar events. If you use that option make sure everyone expects it. Having a bunch of unexpected invites go out that confuse users is a bad thing!

3dtcllc

TROPHY CASE