Note! You can still follow the steps outlined in this page BUT we recommend you now follow the procedure outlined in this post.
Install the General Audit Tool
New Admin Console
1. On the new console, create an OU for the users you want to use the tool …
2. Go into the third party apps section on the control panel, select the ‘General Audit Tool’ only. On the right at the top you will see a filter icon. Select it, pick the top level OU. Now on the left, at the top, (across from the filter icon) you will see ‘on’ and ‘off’ buttons, turn off GAT for everyone….
3. Select the OU you just created for the users you wish to grant permission to. Turn on GAT for this OU and you are done …..
Old Admin Console
Go to ‘Manage this Domain’
Under ‘Organizations and Users’ create an organisation, say ‘Super Admins’ – add the people who you want to run audits, to this Organization*.
Go to ‘Services’ (still under ‘Organizations and Users’ )
Scroll down until you find the entry ‘General Audit Tool’
For the entire domain your_domain.tld, set this to ‘Off’ and hit ‘Save Changes’ (This turns off the GAT for everyone)
Next select the Organisation ‘Super Admins’
Again scroll down to the entry ‘General Audit Tool’ and after selecting ‘Override this Setting’
set this to ‘On’ and Remember to ‘Save Changes’
Now the Organisation ‘Super Admins’ should have all rights of the domain and the extra one of running the Audit tool. You can also enable other Google and non-G Suite for this organization.
* Note: For reasons best known to Google, it seems the Admin that set up the domain can not move that first ‘super admin’ account into a sub-organisation.