For assitance with troubleshooting issues, trial implementations, or engagement with Professional Services, you can grant one or more Google employees temporary access to your Looker instance. The Support Access page in the General section of Looker’s Admin section lets you enable or disable support access, set the duration for how long Google personnel will have access to your instance, and create an allowlist to specify which individuals will have access to your instance.
Versions of Looker prior to 22.0 do not support the ability to grant Google personnel access. If your instance is running a version of Looker prior to 22.0, you must upgrade to Looker 22.0 or later to grant Google personnel access to your instance.
If you have a customer-hosted Looker deployment, you must add Looker’s secure gateway IP address to your allowlist to enable Looker support to access your Looker application.
Viewing status in the help menu
You can view the status of support access in the Looker help menu:
Support access is disabled by default. When access is disabled, the help menu displays Support Access: Off. If access is enabled, the help menu shows the remaining time for which access is enabled:
Viewing status in the Admin section
The Support Access panel, like the help menu, indicates whether and for how long support access is enabled. When support access is disabled, the Support Access panel shows you the option to enable support access:
When support access is enabled, the Support Access panel indicates that support access is open and for how long access will remain open:
Looker admins are able to enable or disable support access. To give this ability to Looker developers, give them a role with the
support_access_togglepermission (directly or through a group).
Granting access to your Looker instance to Google personnel
To grant one or more Google employees access to your Looker instance, you must enable support access to your instance and specify which individuals will have access in the support access allowlist.
Enabling support access
Enabling support access will enable access to your instance for every individual who is listed in the allowlist!
To enable support access to your instance:
Set the duration for which you want to enable access by entering the number of time units and selecting a time unit. The maximum duration for which you can enable access is 90 days.
Check the box to indicate that you understand you are authorizing Google personnel to access your Looker instance.
Click Enable support access.
Specifying individuals who have access
To specify which individuals you want to grant access, in the Support Access Authorization section, click Add users to allowlist. Looker displays the Add users to allowlist dialog:
Enter a comma-separated list of email addresses of the Google employees to whom you want to grant access to your instance. Only Google personnel whose email address ends in “@looker.com” can be granted access.
Select a reason for granting access.
Select the I agree checkbox.
Click Add to allowlist.
Once you have added users to your allowlist, you will see them listed in the Support access user table:
If the Google employee has not logged into your instance, their email address is displayed. If the Google employee has logged in, you will see their name displayed, and their email address will not display again.
Reducing or extending the access duration
Reducing or extending access to your instance will limit or extend access for every individual in the allowlist!
You can change the amount of time for which analysts are granted access to your instance:
Set the duration for which you want to enable access by entering the number of time units and selecting a time unit. The maximum duration for which you can enable access is 90 days.
Check the box to indicate that you understand you are authorizing Google personnel to access your Looker instance.
Click Update support access.
Disabling access
If support access is enabled for any duration, you can disable all support access by clicking Revoke access immediately. This will immediately log out all support access users.
You can also disable access to any individual by clicking the Remove access link in that individual’s row in the Support access user table:
Individuals on the allowlist that were previously granted access
Any time you enable or disable support access, or extend or reduce the duration for which access is granted, this change affects individuals who were previously granted access and are still in the allowlist.
For example, let’s say you grant one day of access to Analyst_A from Looker’s support team to help with some troubleshooting. One week later, you grant access to Analyst_B from Looker’s Professional Services department to assist with configuring a model.
When you enable access for Analyst_B, if Analyst_A is still listed in your allowlist you will also grant Analyst_A access. If you no longer want Analyst_A to have access to your instance, you must remove Analyst_A from your allowlist.
This also holds true if you extend the access duration.
For example, if you grant access to Analyst_A to help with troubleshooting for one week and then two days later you grant one month’s access to Analyst_B to help configure your model, you will have set the support access to be open for one month. In this scenario, you will also have extended access to Analyst_A for the full month. If you want to revoke access to Analyst_A after the troubleshooting is complete, you must remove Analyst_A from your allowlist. There is no option to provide different analysts access for different amounts of time.
Support access audit
The Support Access Audit section shows data about access to your Looker instance in the most recent 90 days, updated hourly.
The Changes to Support Access Settings panel lists the most recent events when your support access settings were changed, and includes:
- Whether support access to your Looker instance was enabled, disabled, or extended
- The name of the user who changed the support access setting, or an explanation for automatic changes (such as expiration of the access timer)
The time and date the setting change occurred
The Recent Access panel shows information about which Google employees have recently accessed your Looker instance, including:
- The name of the Google employee who accessed your Looker instance
- The date that the analyst accessed your instance
- The purpose for which the analyst accessed your instance (this will be one of the following values):
- Professional services support
- Technical support
- Trial development support