Yes, if your district has Education Standard or Education Plus. The security investigation tool in the Admin console searches Gmail log events across the domain and lets you delete the message, mark it as spam or phishing, or send it to quarantine, from the search results.
Not from the Admin console on Education Fundamentals. Fundamentals can tell you exactly who received the message, through Email Log Search and Gmail log events. It cannot act on the message. Removal on Fundamentals means the Gmail API, reached through GAM or a tool built on it.
Everything below is the detail behind those two sentences, so you can read your own license against what an incident will ask of it.
What each edition includes
Google's own edition comparison is the source for every row. The distinction that matters is between the audit and investigation tool, which all three editions have and which reports on log events, and the security investigation tool, which Google describes as "log event reporting with premium features", including "take action based on search results", and which only Standard and Plus have.
| Capability | Education Fundamentals | Education Standard | Education Plus |
|---|---|---|---|
| Email Log Search: find a message by sender, recipient, subject, date | Yes | Yes | Yes |
| Gmail log events: who received what, and what happened to it | Yes | Yes | Yes |
| Drive log events | Yes | Yes | Yes |
| Audit and investigation tool: search and export log events | Yes | Yes | Yes |
| Alert center | Yes | Yes | Yes |
| Content compliance rules: quarantine, reject or modify inbound mail | Yes | Yes | Yes |
| Advanced phishing and malware protection settings | Yes | Yes | Yes |
| Security investigation tool: act on search results | No | Yes | Yes |
| View the content of a Gmail message in the console | No | Yes | Yes |
| Delete a message from users' inboxes domain-wide | No | Yes | Yes |
| Mark a message as spam or phishing, or send it to quarantine, domain-wide | No | Yes | Yes |
| "Investigate reports of malicious emails" (Google's own use-case row) | No | Yes | Yes |
| Gmail log search in BigQuery | No | Yes | Yes |
| Activity rules: alert or act automatically on a log-event pattern | No | Yes | Yes |
Two notes on reading the table honestly.
Fundamentals is not a blind edition. Email Log Search is on every edition, with full delivery detail for 30 days and, beyond that, results by recipient address and message ID. Gmail log events and Drive log events are there too. During an incident, Fundamentals answers "who received it" as well as Plus does. What it lacks is the button that acts on the answer.
Standard and Plus are the same for this job. The rows where Plus goes beyond Standard, such as the advanced activity-rule features Google lists for Education Plus, are not what a phishing removal needs.
How deletion works on Standard and Plus
In the security investigation tool, choose Gmail log events as the data source, build the search (sender, subject, date range), and open a message from the results. Google documents the actions available on it: Delete message, Mark as spam, Mark as phishing, Send to inbox and Send to quarantine. Viewing the message content needs the appropriate privileges and edition; Google covers that on its page about viewing sensitive content.
Google's summary of the tool is the plainest statement of the capability: it lets administrators "find and erase malicious emails, mark emails as spam or phishing, or send emails to users' inboxes."
Prefer Mark as phishing or Mark as spam when they will do. Both move the message out of the inbox, both apply Google's classification, and both are reversible. Deletion is for when policy requires it.
What Fundamentals administrators do instead
The removal step on Fundamentals goes through the Gmail API, and GAM is the common way to reach it. The shape is the same as in the console: search first, act second. The read-only search lists every mailbox that holds the message. Replace the sender address with the exact From address of a preserved copy of the message; Google uses more than one Drive notification address, and the example below is only an example:
gam all users print messages query "from:drive-shares-dm-noreply@google.com subject:(Salary Schedule) newer_than:2d" headers "Date,Subject,To,Delivered-To"Then, once the list is what you expect, move the messages to Trash, where they are recoverable:
gam all users trash messages query "from:drive-shares-dm-noreply@google.com subject:(Salary Schedule) newer_than:2d" doitGAM does nothing without doit; a run without it reports what would happen. A permanent delete exists too, and Google's description of the API call behind it is the caution: "Immediately and permanently deletes the specified message. This operation cannot be undone. Prefer messages.trash instead." The full removal workflow, including when a permanent delete is the right call, is in how to remediate Google Drive share phishing.
Two things Fundamentals administrators should not expect. Email Log Search is a search; it cannot remove or alter a message, on any edition. And the audit and investigation tool on Fundamentals reports; it does not act. Neither is a limitation you can configure around.
Where ORINEX Workspace Compliance fits
Message Removal in ORINEX Workspace Compliance is a review-first wrapper around the same Gmail API that GAM reaches, and it works on any Google Workspace edition, including Education Fundamentals.
You choose a scope, the whole domain, one organizational unit or one group's members, enter a Gmail query, and scan. A scan changes nothing; it lists the matching messages by sender, subject and date and can be repeated to narrow the query. From the reviewed list you select messages and either move them to Spam, which is reversible, or delete them, which requires typing DELETE, acts on the message IDs you reviewed rather than on a fresh search, is permanent, and bypasses Trash. A separate filter can trash future matches by sender or by a phrase in the message. Every action is recorded in the Activity Log with the administrator, the scope and the count. It requires a super administrator and is refused during an evaluation.
What it does not do: it does not show message content, it cannot mark a message as phishing for Google (Google exposes no API for that; moving to Spam is the closest available action), and it cannot send a message to Google's quarantine. If you have Education Standard or Plus, Google's own tool does everything ORINEX does here and those three things besides. The case for ORINEX on this page is Education Fundamentals, and administrators who would rather review a list than type a domain-wide delete at a command line.
Before the incident
Find out which edition you are on before you need this page, in the Admin console under Billing. Then, on Fundamentals, decide in advance how you would remove a message: install and test GAM against a test mailbox, or adopt a tool that wraps it, or decide that Mark-as-spam by users plus content compliance rules is your posture. Discovering mid-incident that the button you were counting on belongs to a different edition is a bad way to spend an afternoon.
Sources
- Compare Education editions — Google Workspace Admin Help. The source for every row in the table.
- About the audit and investigation tool — Google Workspace Admin Help. What is standard and what is "premium features in the security investigation tool."
- About the security investigation tool — Google Workspace Admin Help. Supported editions and "find and erase malicious emails."
- Use the security investigation tool to view sensitive content — Google Workspace Admin Help. The actions on a message.
- Gmail log events — Google Workspace Admin Help.
- Find messages with Email Log Search — Google Workspace Admin Help. Editions and the 30-day limits.
- Create and manage activity rules — Google Workspace Admin Help. Rules act after the event; the advanced features and their editions.
- Set up rules for advanced email content filtering — Google Workspace Admin Help. Content compliance editions.
- Gmail API: users.messages.delete — Google for Developers.
- GAM wiki: Users - Gmail - Messages/Threads — GAM7 documentation.
Related field guides
- How to remediate Google Drive share phishing in Google Workspace
- How to investigate a malicious Google Drive share in Google Workspace
- Using Gmail content compliance to quarantine Google Drive phishing
- What to check after a Google Workspace account is compromised
On Education Fundamentals the Admin console can find a phishing message in every inbox and cannot remove it. Message Removal in ORINEX Workspace Compliance is the review-first version of that removal: scope, query, a scan that changes nothing, and deletion or Spam only for the list you looked at. What ORINEX Workspace does.