Use cases → Admin and governance
Audit which third-party apps can read your mail
List every OAuth grant across the domain and find the retired tools still holding access.
| Who it is for | Security teams and any admin who has connected tools over several years. |
|---|---|
| APIs | Admin SDK |
| Typical scopes | admin.directory.user.security |
The problem
Grants accumulate silently. Trial tools, departed vendors and abandoned scripts keep full mailbox access indefinitely, and nobody has an inventory.
How it works
- Enumerate users through the directory.
- List each user's OAuth tokens and the scopes they carry.
- Flag anything holding mail, Drive or admin scope that nobody recognises.
- Revoke what fails the review.
What changes
A real inventory of who can read your data, and a shorter list after the first pass.
Questions people ask
Can this be done without the API?
Per user, by hand, in the account security page. Across a domain that is not realistic, which is why the grants pile up.
Want this built?
This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.
Talk to us Or read the setup guideRelated use cases
Automate joiners, movers and leavers
Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.
Continuously verify your delegation still works
A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.
Reduce an over-broad delegation grant safely
Find out which scopes your automation genuinely uses, then cut the grant down to them.