Back to Checks
googleworkspace

Comprehensive mail storage is enabled

gmail_comprehensive_mail_storage_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:NotDefined

Comprehensive mail storage ensures that a copy of all sent and received messages in the domain, including messages sent or received by non-Gmail mailboxes, is stored in users' Gmail mailboxes. This makes all messages accessible to Google Vault for retention, eDiscovery, and compliance purposes.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without comprehensive mail storage, messages sent through other Google services (Calendar, Drive, etc.) may not be stored in Gmail and therefore not subject to Vault retention policies. This creates gaps in compliance coverage, eDiscovery, and audit trails that could violate regulatory requirements.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_comprehensive_mail_storage_enabled

Recommendation

Enable comprehensive mail storage to ensure all email is stored in Gmail mailboxes for Vault retention and eDiscovery compliance.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Compliance** > **Comprehensive mail storage**
4Check **Ensure that a copy of all sent and received mail is stored in associated users' mailboxes**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_comprehensive_mail_storage_enabled(Check):
    """Check that comprehensive mail storage is enabled.

    This check verifies that the domain-level Gmail policy ensures a copy
    of all sent and received mail is stored in users' Gmail mailboxes,
    making all messages accessible to Vault for compliance and eDiscovery.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            storage_enabled = gmail_client.policies.comprehensive_mail_storage_enabled

            if storage_enabled is True:
                report.status = "PASS"
                report.status_extended = (
                    f"Comprehensive mail storage is enabled "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                if storage_enabled is None:
                    report.status_extended = (
                        f"Comprehensive mail storage is not explicitly configured "
                        f"in domain {gmail_client.provider.identity.domain}. "
                        f"Comprehensive mail storage should be enabled for compliance."
                    )
                else:
                    report.status_extended = (
                        f"Comprehensive mail storage is disabled "
                        f"in domain {gmail_client.provider.identity.domain}. "
                        f"Comprehensive mail storage should be enabled for compliance."
                    )

            findings.append(report)

        return findings

References