1. Required Permissions
Find the collectors and query commands you will use in the tables, and choose an authentication method from the Supported authentication column. Then note the values in the same row. You will register them as-is in the later setup steps.
- Admin privileges: add to the admin role in 2. Google Workspace Preparation
- Google Cloud API: enable in 2. Google Workspace Preparation
- OAuth scopes: register in domain-wide delegation for 3-1. Service Account, or when issuing the refresh token for 3-2. User Account OAuth
You do not need to prepare permissions for features you will not use. Only the features missing permissions fail, and the error message shows the required action.
Note
The five collectors other than Alert Center and the
*-logs query commands all use the admin.reports.audit.readonly scope and the Reports admin privilege. If you only collect audit logs, this scope and privilege are all you need. The Drive Activity collector and drive-logs additionally need the drive.apps.readonly scope (for app name lookup) and the Google Drive API.
Admin privileges refer to the Admin privileges section of Admin roles in the Admin console.
Collectors
| Collector (logger model) | Supported authentication | Admin privileges | Google Cloud API | OAuth scopes |
|---|---|---|---|---|
| Google Workspace Alert Center | Service account only | See Admin Privileges by Alert Type below | Google Workspace Alert Center API | https://www.googleapis.com/auth/apps.alerts |
| Google Workspace Admin Activity | Service account, OAuth | Reports | Admin SDK API | https://www.googleapis.com/auth/admin.reports.audit.readonly |
| Google Workspace Login | Service account, OAuth | Reports | Admin SDK API | https://www.googleapis.com/auth/admin.reports.audit.readonly |
| Google Drive Activity | Service account, OAuth | Reports | Admin SDK API, Google Drive API | https://www.googleapis.com/auth/admin.reports.audit.readonly, https://www.googleapis.com/auth/drive.apps.readonly |
| Google Meet Activity | Service account, OAuth | Reports | Admin SDK API | https://www.googleapis.com/auth/admin.reports.audit.readonly |
| Google Chat Activity | Service account, OAuth | Reports | Admin SDK API | https://www.googleapis.com/auth/admin.reports.audit.readonly |
Query Commands
Query command names omit the common prefix google-workspace-. For example, users is the google-workspace-users command.
| Query command | Supported authentication | Admin privileges | Google Cloud API | OAuth scopes |
|---|---|---|---|---|
| alerts | Service account only | See Admin Privileges by Alert Type below | Google Workspace Alert Center API | https://www.googleapis.com/auth/apps.alerts |
| admin-logs | Service account, OAuth | Reports | Admin SDK API | https://www.googleapis.com/auth/admin.reports.audit.readonly |
| login-logs | Service account, OAuth | Reports | Admin SDK API | https://www.googleapis.com/auth/admin.reports.audit.readonly |
| drive-logs | Service account, OAuth | Reports | Admin SDK API, Google Drive API | https://www.googleapis.com/auth/admin.reports.audit.readonly, https://www.googleapis.com/auth/drive.apps.readonly |
| meet-logs | Service account, OAuth | Reports | Admin SDK API | https://www.googleapis.com/auth/admin.reports.audit.readonly |
| chat-logs | Service account, OAuth | Reports | Admin SDK API | https://www.googleapis.com/auth/admin.reports.audit.readonly |
| oauth-logs | Service account, OAuth | Reports | Admin SDK API | https://www.googleapis.com/auth/admin.reports.audit.readonly |
| domains | Service account, OAuth | Domain Management | Admin SDK API | https://www.googleapis.com/auth/admin.directory.domain.readonly |
| users | Service account, OAuth | Domain Management, Users > Read | Admin SDK API | https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/admin.directory.user.readonly |
users (group option) | Service account, OAuth | Domain Management, Users > Read, Groups > Read | Admin SDK API | https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly |
| groups | Service account, OAuth | Domain Management, Groups > Read | Admin SDK API | https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly |
| drive-apps | Service account, OAuth | None | Google Drive API | https://www.googleapis.com/auth/drive.apps.readonly |
| drive-app | Service account, OAuth | None | Google Drive API | https://www.googleapis.com/auth/drive.apps.readonly |
| sheets-values | Service account, OAuth | None (share the target sheet with view access) | Google Sheets API | https://www.googleapis.com/auth/spreadsheets.readonly |
| sheets-write-values | Service account, OAuth | None (share the target sheet with edit access) | Google Sheets API | https://www.googleapis.com/auth/spreadsheets |
Admin Privileges by Alert Type
The Alert Center collector and the google-workspace-alerts query command need different admin privileges depending on the type of alert to collect.
| Alerts to collect | Admin privileges |
|---|---|
| System alerts (e.g., admin privileges granted to a user) | Services > Alert Center > Full access > View access |
| Activity rule alerts (alerts from rules created in Rules in the Admin console) | Services > Alert Center > Full access > View access, Services > Security Center > Activity Rules > View, Services > Security Center > Audit and investigation > View > Rules |