For assistance with troubleshooting issues, trial implementations, or engagement with Professional Services, you can grant one or more Google employees temporary access to your Looker instance. The Support Accesspage in the Generalsection of Looker's Adminsection lets you enable or disable support access, set the duration for how long Google personnel will have access to your instance, and create an allowlist to specify which individuals will have access to your instance.
Versions of Looker earlier than 22.0 don't support the ability to grant Google personnel access. If your instance is running a version of Looker earlier than 22.0, you must upgrade to Looker 22.0 or later to grant Google personnel access to your instance.
If you have a customer-hosted Looker deployment or a Looker-hosted deployment with an IP allowlist , you must add Looker's secure gateway IP address to your allowlist to enable Looker support to access your Looker application.
Viewing status in the Help menu
You can view the status of support access in the Looker Helpmenu .
Support access is disabled by default. When access is disabled, the Helpmenu displays Support Access: Off. If access is enabled, the help menu shows the remaining time for which access is enabled.
Viewing status in the Admin section
The Support Accesspanel, like the Helpmenu, indicates whether and for how long support access is enabled. When support access is disabled, the Support Accesspanel shows you the option to enable support access.
When support access is enabled, the Support Accesspanel indicates that support access is open and for how long access will remain open.
Using support access with Looker (Google Cloud core)
When you use support access with Looker (Google Cloud core) , support access is available only for public secure connections instances . Support access is notavailable for private connections or hybrid connections instances.
Granting access to your Looker instance to Google personnel
To grant one or more Google employees access to your Looker instance, you must enable support access to your instance and specify which individuals will have access in the support access allowlist.
Enabling support access
You can enable support access in the Enabling Support Accesssection on the Support Accesspage in the Looker Adminpanel. Enabling support access will enable access to your instance for every individual who is listed in the allowlist . To enable support access to your instance, follow these steps:
-
Configure support access: Set the level of access that you want to grant to all Google Support personnel who are listed in the Support users with accesssection. The configure support access options are the following:
- Support (Basic Editor): A read-only admin role with a basic set of permissions .
- Support (Advanced Editor): A read-only admin role with an advanced set of permissions .
- Customer Engineer (Advanced Editor): A read and write admin role with an advanced set of permissions that includes the permissions to create and deploy content .
The Support Basic Editor, Support Advanced Editor, and Customer Engineer Advanced Editorroles can be granted only to members of the Google Cloud support team or Google Cloud customer engineers who have been added to the instance through the Support Accesspage and cannot be given to other Looker users.
-
Set Access Duration: Set the duration for which you want to enable access. For the Support Basic Editoror Support Advanced Editorrole, enter the number of hours for which you want to enable access. For the Customer Engineer Advanced Editorrole, enter the number of days. The Set Access Durationfield is automatically populated with the default value for the role you select.
-
The default duration for the Support Basic Editorrole or Support Advanced Editorrole is 1 hour. The maximum duration for these roles is 48 hours.
-
The default duration for the Customer Engineer Advanced Editorrole is 1 day. The maximum duration for this role is 14 days.
Access duration for a user begins when Updateis clicked to enable support access.
-
-
Select the box to indicate that you understand you are authorizing Google personnel to access your Looker instance.
-
To update the support setting, click Update.
See the Individuals on the allowlist who were previously granted access section for more information on how support access settings affect support users who have already been added to the allowlist.
Specifying individuals who have access
In the Support users with accesssection, select Add users to allowlist. Looker displays the Add users to allowlistdialog. To specify the individuals to whom you want to grant access, follow these steps:
-
Enter a comma-separated list of email addresses of the Google employees to whom you want to grant access to your instance. Only Google personnel whose email address ends in "@google.com" can be granted access.
-
Select a reason for granting access.
-
Click Add to allowlist.
Once you have added users to your allowlist, they will be listed in the Support access usertable. If the Google employee has not logged in to your instance, their email address is displayed. If the Google employee has logged in, you will see their name displayed, and their email address won't be displayed again.
The duration of a user's access begins when support access was enabled, not when the user was added or logged in. For example, if X
hours of support access was enabled and a user was added 3 hours later, that user will have X
-3 hours of access.
Access levels for support users
Support users who are added to the allowlist are granted the Support Basic Editorrole
, Support Advanced Editorrole
, or Customer Engineer Advanced Editorrole
, depending on the role that is selected in the Configure support accessfield. Their permissions within the Looker instance are based on the permissions that are assigned to the selected role. These users cannot be granted other roles or added to Groups
. The see_admin
permission within each of these roles grants read-only access to many pages in the Adminpanel; however, users won't have access to the following Adminpanel pages:
- Support Access
- Labs
- Legacy Features
- Export
- Content Access
- Actions(if the page displays only the enabled or disabled states of actions)
Additionally, some features or settings may be hidden on pages that support users do have access to.
If you change the Configure support accesssetting for your instance, the update to the role for each support user occurs after that user has logged out and logged back in again.
Reducing or extending the access duration
You can change the amount of time for which analysts are granted access to your instance in the Set Access Durationfield. To change the amount of time, follow these steps:
-
In the Select Access Levelsection, select the access level role for which you would like to reduce or increase access.
-
Set the duration for which you want to enable access by updating the number of hours or days. The maximum duration for the Support Basic Editoror Support Advanced Editorrole is 48 hours. The maximum duration for the Customer Engineer Advanced Editorrole is 14 days.
-
Select the box to indicate that you understand you are authorizing Google personnel to access your Looker instance.
-
Click Update. If you want to extend access duration by the same duration that is already entered in the Set Access Durationfield, click Update.
Disabling access
If support access is enabled for any duration, you can disable all support access by selecting Revokein the Enabling Support Accesssection of the Support Accesspanel. This action will immediately log out all support access users.
You can also disable access to any individual by selecting the Remove Accesslink in that individual's row in the Support users with accesstable.
Individuals on the allowlist who were previously granted access
Any time you enable or disable support access, or extend or reduce the duration for which access is granted, this change affects individuals who were previously granted access and are still in the allowlist.
For example, you grant one day of access to Analyst_A from Looker's Support team to help with some troubleshooting. One week later, you grant access to Analyst_B from Looker's Professional Services department to assist with configuring a model.
When you enable access for Analyst_B, if Analyst_A is still listed in your allowlist you will also grant Analyst_A access. If you no longer want Analyst_A to have access to your instance, you must remove Analyst_A from your allowlist.
This also holds true if you extend the access duration.
For example, if you grant access to Analyst_A to help with troubleshooting for one day and then two weeks later you grant 36 hours of access to Analyst_B to help configure your model, you will have set the support access to be open for 36 hours. In this scenario, you will also have extended access to Analyst_A for 36 hours. If you want to revoke access to Analyst_A after the troubleshooting is complete, you must remove Analyst_A from your allowlist. There is no option to provide different analysts access for different amounts of time.
Similarly, if you update the Configure support accesssetting for your instance, all users in the allowlist will now have the updated role that is listed in the setting. In addition, when you click the Updatebutton to update the Configure support accesssetting, you also reset the clock on the access duration that users have to the hours or days that are set in the Set Access Durationfield.
Viewing changes made to support access
To see changes that relate to support access, click the Support Access Audit Dashboardlink to display the Support Access Audit dashboard. This dashboard shows data about access to your Looker instance in the most recent 90 days, updated hourly.
The Changes to Support Access Settingstile lists the most recent events when your support access settings were changed, and includes:
- Whether support access to your Looker instance was enabled, disabled, or extended
- The name of the user who changed the support access setting, or an explanation for automatic changes (such as expiration of the access timer)
- The time and date the setting change occurred
The Recent Accesstile shows information about which Google employees have recently accessed your Looker instance, including:
- The name of the Google employee who accessed your Looker instance
- The date that the analyst accessed your instance
- The purpose for which the analyst accessed your instance (this will be one of the following values):
- Professional Services support
- Technical Support
- Trial Development Support
Legacy support access
If you are using a Looker (original) instance and the Tiered Support Access Labs feature has been disabled, the Support Accesspage in the Adminsection of Looker behaves differently in the following ways:
- The maximum duration for support access is 90 days.
- Admins cannot assign the Support Advanced Editor, Support Basic Editor, or Customer Engineer Advanced Editorroles. Any support users added to an instance's allowlist will have the Admin role.
- Support users can be added to Groups.
To enable legacy support access to your instance, follow these steps:
-
Set the duration for which you want to enable access by entering the number of time units and selecting a time unit from the drop-down menu. The maximum duration for which you can enable access is 90 days.
-
Select the box to acknowledge that you are authorizing Google personnel to access your Looker instance.
-
Click Enable support access.
