Support access
Glean Support sometimes needs temporary access to your workspace to resolve a support issue. When your deployment requires customer approval for that access, admins approve or deny each request on the Support access page. Admins can also grant or revoke access directly and review a history of past requests and decisions.
Prerequisites
Before you begin, make sure that:
- You have the Admin or Super Admin role. Both roles can manage roles and permissions. See Administrator roles.
- Your deployment uses the customer approval flow for support access. The Support access page appears only when Glean has turned on this flow for your deployment. If you don't see the page, contact Glean Support.
- You're signed in to Glean with single sign-on (SSO).
Open the Support access page
Go to Admin console → Users and permissions → Support access.
The top of the page shows whether Glean Support has access to your workspace right now (On or Off) and how long each grant lasts. Access expires automatically at the end of that period. Glean rounds the end time down to the hour, so access can end up to one hour before the full duration.
Respond to a support access request
When Glean Support requests access, the page shows the message "Glean Support has requested access for" followed by the access duration.
- To allow access, click Approve. Glean Support has access until the end of the access period or until you revoke it.
- To refuse access, click Deny.
Grant access directly
When Glean Support doesn't have access and no request is waiting for a decision, you can grant access without a request. Click Grant access. The grant lasts for the same duration as an approved request.
Revoke access
While Glean Support has access, the page shows when the access expires. To end access immediately, click Revoke access.
Review request history
The Request history section on the Support access page lists support access requests, the decisions your admins recorded, and direct grants. The most recent record appears first.
Request history columns
| Column | What it shows |
|---|---|
| Requested by | Who asked for access, and when. Requests from Glean Support show a dash (–), because Glean doesn't display the internal identifier it stores for them. Direct grants show the admin who granted access. |
| Justification | The reason given for the request. Shows No justification provided when the request has no reason. Direct grants show "Self-granted debug access". |
| Customer decision | The decision recorded for the request: Pending, Approved, or Denied. See Decision labels. |
| Responded by | The admin who approved or denied the request, and when. If Glean can't find an email address for the admin, for example because their account was deleted, the column shows the stored identifier instead. Shows a dash (–) for pending requests. |
| Access end | When access ended or is scheduled to end. If an admin revoked access, it shows when the revocation took effect. Shows a dash (–) for pending and denied requests. |
Decision labels
| Label | Meaning |
|---|---|
| Pending | No admin has approved or denied the request yet. |
| Approved | An admin approved the request, or granted access directly. |
| Denied | An admin denied the request. Glean Support didn't get access from it. |
The Customer decision column records how your admins responded to a request. It doesn't show whether Glean Support has access now. A request stays Approved after its access expires or is revoked. To check current access, look at the On or Off status at the top of the Support access page, or compare Access end with the current time.
When an admin revokes access, the history doesn't record who revoked it. The record keeps its Approved label, and its Access end time changes to the time of the revocation. Request history isn't a complete audit log of support access.
Move between pages
Request history shows 25 records per page. To see older records, click Next. To return to newer records, click Previous. The current page number appears between the buttons.
When an admin approves, denies, grants, or revokes access from this page, the history refreshes and returns to the first page, where the new or updated record appears.
When request history doesn't show records
- No support access requests yet — Your deployment has no support access requests or direct grants.
- Unable to load request history — Glean couldn't load the history. Click Retry to try again. If the error happens while you move to the next page, the pages that already loaded stay available.
Understand what request history covers
Request history covers only the support access requests and grants managed on the Support access page. It doesn't include:
- Glean's operational access to customer-hosted infrastructure, such as read-only IAM roles for monitoring. See Monitoring and debugging access.
- Service restoration during incidents, which uses a separate, independently audited process. See Service restoration access.
- Audit logs from your cloud provider.
See also
- Audit Logs — review configuration changes that admins and Glean Support make in Glean