User Directory Access
OAuth Scope:
https://www.googleapis.com/auth/admin.directory.user.readonly
This allows us to read user account information from the Google Workspace directory.
We use this access to understand:
-
Which users exist in the tenant
-
Whether accounts are active or suspended
-
How accounts are organized
-
Whether basic user information is complete and consistent
This is important because user accounts form the foundation of access control. Inactive, duplicate, or unmanaged accounts can create security and compliance risks.
Group and Membership Access
OAuth Scope:
https://www.googleapis.com/auth/admin.directory.group.readonly
This allows us to read Google Groups and group membership information.
We use this access to understand:
-
Which groups exist in the environment
-
Who belongs to each group
-
How access may be granted through group membership
This is important because groups often control access to shared resources, applications, email distribution lists, and administrative workflows. Incorrect or outdated group memberships can expose sensitive data or provide users with unnecessary access.
Organizational Unit Access
OAuth Scope:
https://www.googleapis.com/auth/admin.directory.orgunit.readonly
This allows us to read organizational units in Google Workspace.
We use this access to understand:
-
How users and devices are structured
-
Departmental or regional segregation
-
Business unit or policy-based organization
This is important because Google Workspace security settings and policies are often applied based on organizational units. If users or devices are assigned incorrectly, they may receive wrong security policies.
Administrative Role Access
OAuth Scope:
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
This allows us to read administrator roles and role assignments.
We use this access to identify:
-
Which users have elevated administrative privileges
-
What level of administrative access they possess
-
How privileged access is distributed across the environment
This is important because administrator accounts are high-value targets. Reviewing role assignments helps confirm that privileged access is appropriate, limited, and aligned with the principle of least privilege.
Domain Configuration Access
OAuth Scope:
https://www.googleapis.com/auth/admin.directory.domain.readonly
This allows us to read domain information configured in Google Workspace.
We use this access to understand:
-
Which domains are associated with the tenant
-
Whether the environment includes primary domains, secondary domains, or aliases
-
How identities and email routing are structured
This is important because domain configuration affects user identity, account ownership, email routing, and tenant boundaries.