domainwidedelegation.comStart free

Use cases → Admin and governance

Centralized alerting for suspicious Workspace logins

Detect and notify on suspicious sign-ins across all users by polling audit logs with a delegated service account, not relying on per-user settings.

Who it is forSecurity operations and IT admins responsible for monitoring Workspace account access.
APIsAdmin SDK
Typical scopesadmin.reports.audit.readonly

The problem

Workspace's built-in alerting is user-centric and inconsistent across tenants, making it easy to miss or duplicate incidents. Manual review of login events doesn't scale and is prone to human error.

How it works

  1. Schedule a job to poll the Reports API for login events across the domain.
  2. Filter for event types and risk indicators that match suspicious activity (e.g., unfamiliar locations, failed attempts, or flagged devices).
  3. De-duplicate events based on eventId and timestamp to avoid alert storms.
  4. Route actionable alerts to a central system or on-call rotation, not to end users.

What changes

A single place to see and act on risky logins across all users, with consistent logic and no dependency on user inboxes or local admin settings.

The trap in this one. The Reports API can lag behind real-world events by several minutes, and polling too frequently will simply return cached data with no new events. If your logic assumes near-real-time detection or retries on empty results, you risk missing the update window entirely or generating duplicate alerts when the backend catches up. Always track the last processed eventId and implement backoff on polling intervals.

Questions people ask

Does this catch all suspicious activity instantly?

No. The Reports API typically lags by several minutes and does not stream events in real time. It's best suited for periodic polling, not immediate response.

Can we use this for multiple domains?

Yes, but each tenant requires separate polling and tracking, as event IDs and timelines do not align between domains.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Audit which third-party apps can read your mail

List every OAuth grant across the domain and find the retired tools still holding access.

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.