OAuth Scopes

The following tables summarize all OAuth scopes and permissions required for the Google Workspace adapter in Axonius.

For detailed instructions on configuring Google Workspace OAuth scopes, refer to the Google Workspace Admin SDK documentation.

Google Cloud APIs to Enable

Permissions for Connection Settings

Additional permissions

Permissions for Advanced Configurations

Organizational Unit Details

The adapter enriches Users, ChromeOS devices, and Chrome browsers with Organizational Unit (OU) details. To retrieve these details, add the following scope to the domain-wide delegation of the service account that Axonius uses, and then run a fetch:

https://www.googleapis.com/auth/admin.directory.orgunit.readonly (Admin SDK API)

The following fields are added to Users, ChromeOS devices, and Chrome browsers:

• Org Unit Name - The name of the Organizational Unit.
• Org Unit ID - The ID of the Organizational Unit.
• Org Unit Parent Path - The path of the parent Organizational Unit, for example /Sales.
• Org Unit Parent ID - The ID of the parent Organizational Unit.
• Org Unit Description - The description of the Organizational Unit.
• Org Unit Hierarchy - A list of Organizational Unit names, from the root Organizational Unit to the Organizational Unit of the user or device.

If the scope is missing, the fetch continues and the users and devices are fetched without these fields. Mobile devices and Cloud Identity devices do not receive these fields.

Scopes to Copy and Paste

These are the scopes that you can copy and paste.

Minimum Scopes to Copy

https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly

Recommended for Standard Use to Copy

https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/admin.directory.customer.readonly,
https://www.googleapis.com/auth/admin.directory.domain.readonly,
https://www.googleapis.com/auth/admin.directory.orgunit.readonly,
https://www.googleapis.com/auth/cloud-identity.devices.readonly,
https://www.googleapis.com/auth/admin.reports.usage.readonly,
https://www.googleapis.com/auth/apps.groups.settings

All Cyber Asset Scopes with Axonius SaaS Application to Copy

https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/admin.directory.customer.readonly,
https://www.googleapis.com/auth/admin.directory.domain.readonly,
https://www.googleapis.com/auth/admin.directory.orgunit.readonly,
https://www.googleapis.com/auth/cloud-identity.devices.readonly,
https://www.googleapis.com/auth/admin.reports.usage.readonly,
https://www.googleapis.com/auth/apps.groups.settings,
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,
https://www.googleapis.com/auth/admin.directory.user.security,
https://www.googleapis.com/auth/admin.reports.audit.readonly,
https://www.googleapis.com/auth/calendar,
https://www.googleapis.com/auth/cloud-identity.groups,
https://www.googleapis.com/auth/chrome.management.reports.readonly,
https://www.googleapis.com/auth/chrome.management.policy.readonly,
https://www.googleapis.com/auth/chat.admin.spaces,
https://www.googleapis.com/auth/chrome.management.profiles.readonly

Roles

To create the least privileged role, when the Admin role is not provided.

1. In the Admin Privileges section, select the following permissions:

   • Organization Units > Read

   • Users > Read

   • Security

     • User Security Management (select this)
     • Control Security Settings > Read and Write

   • Domain Management> (select this)

   • Reports > (select this)

2. Expand the Services section and select the following permissions:

   • Directory settings > Settings
   • Looker Studio > Manage Data Studio Settings
   • Sites > Manage Google Sites
   • Google Vault > View All Matters
   • Calendar > All Settings > Settings
   • Data Security > Access Level Management
   • Data Security > Rule Management
   • Classroom > Settings
   • Google Chat > Settings (Read and Modify)
   • Directory Sync > Manage Directory Sync Settings > Read Directory Sync Settings
   • Google Hangouts > Settings
   • YouTube > Manage YouTube Settings
   • Google Meet > Manage Meet Settings
   • Pinpoint > Admin settings for Pinpoint
   • Contacts > Contacts Settings Message > Delegates Read
   • Currents > Settings
   • Gmail > Settings
   • Groups for Business > Settings
   • Cloud Search > Settings
   • Shared device settings > Parent privilege for Managing all common device configurations > Manage all common device configurations
   • Mobile Device Management > Manage Devices and Settings
   • Drive and Docs > Settings
   • Google Workspace Marketplace > Manage access to allowlisted apps
   • Alert Center > Full access > View access
   • Jamboard > Manage Jamboard Settings
   • Chrome Management > Settings > Manage User Settings
   • Chrome Management > Settings > Managed Browsers > Read
   • Chrome Management > Settings > Manage Printers
   • Chrome Management > Settings > Manage Chrome OS Devices > Manage Chrome OS Devices (read only)
   • Chrome Management > Settings > Manage Chrome OS Device Settings
   • App Maker > Settings
   • Google Cloud Print > Cloud Print Manager

3. Expand the Services > Security Center section:

   1. Ensure that the user has full administrative rights for VirusTotal > View Report.

   2. Ensure that the user has full administrative rights for the following Investigation Tool related permissions:

      • Gmail > View Metadata and Attributes
      • Drive > View Metadata and Attributes
      • Device > View Metadata and Attributes
      • User > View Metadata and Attributes
      • OAuth > View Metadata and Attributes
      • Rule > View Metadata and Attributes
      • Chrome > View Metadata and Attributes
      • Meet > View Metadata and Attributes
      • Groups > View Metadata and Attributes
      • Voice > View Metadata and Attributes
      • Calendar > View Metadata and Attributes
      • Admin > View Metadata and Attributes
      • Activity Rules > View

In the Admin API Privileges section, select the following permissions:

• Organization Units > Read
• Users > Read
• Groups > Read
• User Security Management
• Schema Management > Schema Read
• License Management > License Read
• Billing Management > Billing Read
• Domain Management
• Domain Allowlist Management > Domain Allowlist Read.

Enforcement Center Actions (Write Scopes)