domainwidedelegation.comStart free

Use cases → Admin and governance

Automate suspicious login alerts across Workspace tenants

Detect suspicious logins and dispatch alerts automatically, so admins can act before a compromised account escalates.

Who it is forSecurity or IT teams responsible for monitoring Workspace account activity.
APIsAdmin SDK, Gmail API
Typical scopesadmin.reports.audit.readonly, gmail.send

The problem

Manual review of login audit logs is slow and inconsistent, letting compromised accounts go unnoticed for hours or days. Timely alerting is critical, but building it yourself means dealing with API quirks and event delays.

How it works

  1. Poll the Admin SDK's Reports API for suspicious login events using a service account with domain-wide delegation.
  2. Filter events for risk signals such as unfamiliar locations, impossible travel, or repeated failed logins.
  3. Format a clear alert message and send it by email via the Gmail API as a trusted automation sender.
  4. Log each alert sent for audit and deduplication purposes.

What changes

Admins receive actionable alerts within minutes of suspicious activity, and there is a record of what was flagged and when.

The trap in this one. The Reports API can lag by several minutes—sometimes up to 15—after an event occurs, so polling more frequently does not guarantee real-time detection. Worse, the API occasionally emits duplicate events with different event IDs for the same login, leading to repeated alerts if you only deduplicate by ID. Always deduplicate based on a tuple of timestamp, user, and IP/location, not just event ID.

Questions people ask

How often should we poll for new events?

Polling every 5–10 minutes is practical. Polling more frequently won’t reduce detection latency due to API lag, and may hit rate limits.

Do we need to alert on every suspicious login?

No—filter for high-confidence signals. Over-alerting leads to ignored email and alert fatigue.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.

Reduce an over-broad delegation grant safely

Find out which scopes your automation genuinely uses, then cut the grant down to them.