To provide the security team with access to the Security Investigation Tool, the appropriate privileges must be granted through a custom admin role.
* Create Custom Admin Role:
* In the Google Admin console, navigate to Admin roles.
* Click on Create new role.
* Assign Security Center Privileges:
* Name the role appropriately, such as "Security Investigator".
* Under Privileges, expand the Security Center section.
* Select the necessary privileges, including access to the Security Investigation Tool.
* Assign Role to Users:
* After creating the role, go to the Admin roles section.
* Click on Assign users and add the relevant security team members to this custom role.
* Save and Verify:
* Save the role and verify that the assigned users have the correct access.
Creating a custom admin role with specific security privileges ensures that the security team has the necessary tools to perform their duties without granting excessive permissions.
References:
* Manage admin roles
* Security Center overview

* Inbound Gateway Configuration:
* An inbound mail gateway ensures that all incoming emails are routed through specified servers.
* Configuring the inbound gateway to recognize your Exchange server IP addresses prevents internal emails from being marked as spam.
* Steps to Configure:
* Go to the Google Admin console.
* Navigate to Apps > Google Workspace > Gmail > Advanced settings.
* Scroll to the "Spam, Phishing, and Malware" section.
* Configure the "Inbound Gateway" settings:
* Add your Exchange server IP addresses.
* Ensure these addresses are listed as trusted sources.
References
* Google Workspace Admin Help: Configure Inbound Mail Gateway

To investigate the cause of a missing email, you need to collect:
* The email address of the sender.
* The subject of the missing message.
* The date and time when the message was expected. This information allows you to search the email logs in the Admin console to track the email's journey and identify any issues that may have caused it to be delayed or not delivered.
References:
* Google Workspace Admin Help - Track email with email log search

To recover user accounts deleted two weeks ago:
* Sign in to the Admin console as a Super Admin.
* Navigate to user management.
* Use the filter to select "recently deleted" users.
* Recover the deleted user accounts from the list.
Google Workspace allows recovery of deleted users within a 20-day window.
References:
* Google Workspace Admin Help: Restore a recently deleted user

https://support.google.com/vault/answer/2473458?hl=en