OAuth Scopes

The following tables summarize all OAuth scopes and permissions required for the Google Workspace adapter in Axonius.

For detailed instructions on configuring Google Workspace OAuth scopes, refer to the Google Workspace Admin SDK documentation.

Google Cloud APIs to Enable

Permissions for Connection Settings

Additional permissions

Permissions for Advanced Configurations

Scopes to Copy and Paste

These are the scopes that you can copy and paste.

Minimum Scopes to Copy

https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly

Recommended for Standard Use to Copy

https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/admin.directory.customer.readonly,
https://www.googleapis.com/auth/admin.directory.domain.readonly,
https://www.googleapis.com/auth/cloud-identity.devices.readonly,
https://www.googleapis.com/auth/admin.reports.usage.readonly,
https://www.googleapis.com/auth/apps.groups.settings

All Cyber Asset Scopes with Axonius SaaS Application to Copy

https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/admin.directory.customer.readonly,
https://www.googleapis.com/auth/admin.directory.domain.readonly,
https://www.googleapis.com/auth/cloud-identity.devices.readonly,
https://www.googleapis.com/auth/admin.reports.usage.readonly,
https://www.googleapis.com/auth/apps.groups.settings,
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,
https://www.googleapis.com/auth/admin.directory.user.security,
https://www.googleapis.com/auth/admin.reports.audit.readonly,
https://www.googleapis.com/auth/calendar,
https://www.googleapis.com/auth/cloud-identity.groups,
https://www.googleapis.com/auth/chrome.management.reports.readonly,
https://www.googleapis.com/auth/chrome.management.policy.readonly,
https://www.googleapis.com/auth/chat.admin.spaces

Roles

To create the least privileged role, when the Admin role is not provided.

1. In the Admin Privileges section, select the following permissions:

   • Organization Units > Read

   • Users > Read

   • Security

     • User Security Management (select this)
     • Control Security Settings > Read and Write

   • Domain Management> (select this)

   • Reports > (select this)

2. Expand the Services section and select the following permissions:

   • Directory settings > Settings
   • Looker Studio > Manage Data Studio Settings
   • Sites > Manage Google Sites
   • Google Vault > View All Matters
   • Calendar > All Settings > Settings
   • Data Security > Access Level Management
   • Data Security > Rule Management
   • Classroom > Settings
   • Google Chat > Settings (Read and Modify)
   • Directory Sync > Manage Directory Sync Settings > Read Directory Sync Settings
   • Google Hangouts > Settings
   • YouTube > Manage YouTube Settings
   • Google Meet > Manage Meet Settings
   • Pinpoint > Admin settings for Pinpoint
   • Contacts > Contacts Settings Message > Delegates Read
   • Currents > Settings
   • Gmail > Settings
   • Groups for Business > Settings
   • Cloud Search > Settings
   • Shared device settings > Parent privilege for Managing all common device configurations > Manage all common device configurations
   • Mobile Device Management > Manage Devices and Settings
   • Drive and Docs > Settings
   • Google Workspace Marketplace > Manage access to allowlisted apps
   • Alert Center > Full access > View access
   • Jamboard > Manage Jamboard Settings
   • Chrome Management > Settings > Manage User Settings
   • Chrome Management > Settings > Managed Browsers > Read
   • Chrome Management > Settings > Manage Printers
   • Chrome Management > Settings > Manage Chrome OS Devices > Manage Chrome OS Devices (read only)
   • Chrome Management > Settings > Manage Chrome OS Device Settings
   • App Maker > Settings
   • Google Cloud Print > Cloud Print Manager

3. Expand the Services > Security Center section:

   1. Ensure that the user has full administrative rights for VirusTotal > View Report.

   2. Ensure that the user has full administrative rights for the following Investigation Tool related permissions:

      • Gmail > View Metadata and Attributes
      • Drive > View Metadata and Attributes
      • Device > View Metadata and Attributes
      • User > View Metadata and Attributes
      • OAuth > View Metadata and Attributes
      • Rule > View Metadata and Attributes
      • Chrome > View Metadata and Attributes
      • Meet > View Metadata and Attributes
      • Groups > View Metadata and Attributes
      • Voice > View Metadata and Attributes
      • Calendar > View Metadata and Attributes
      • Admin > View Metadata and Attributes
      • Activity Rules > View

In the Admin API Privileges section, select the following permissions:

• Organization Units > Read
• Users > Read
• Groups > Read
• User Security Management
• Schema Management > Schema Read
• License Management > License Read
• Billing Management > Billing Read
• Domain Management
• Domain Allowlist Management > Domain Allowlist Read.

Enforcement Center Actions (Write Scopes)