domainwidedelegation.comStart free

Use cases → Admin and governance

Audit Google Workspace security group membership

Enumerate all members of security groups to find unexpected access, ex-employees, or risky external users before they cause incidents.

Who it is forSecurity and IT operations teams responsible for least-privilege reviews and access audits.
APIsAdmin SDK
Typical scopesadmin.directory.group.readonly, admin.directory.group.member.readonly

The problem

Security groups routinely outlive their original purpose. Memberships are added for projects, mergers, or one-off needs, but rarely removed. Over time, privileged groups accumulate dormant or external users, and the only way to spot this is a point-in-time dump.

How it works

  1. Use a delegated service account with read-only scopes for groups and group members.
  2. Enumerate all groups, filtering by naming convention or admin notes to identify security-relevant ones.
  3. List all members per group, flagging external or suspended accounts.
  4. Export results with metadata for review or cross-check.

What changes

You get a current, machine-readable list of every user with privileged group access, including external and orphaned accounts.

The trap in this one. The Admin SDK paginates group member lists, but the 'nextPageToken' occasionally skips members if the group is being modified during the audit. We've seen audits miss entire cohorts of new or removed users when large groups are updated mid-enumeration. Always snapshot group membership at a quiet time, or re-audit if changes are ongoing.

Watch it explained

“Google Workspace | How to use the investigation tool | GWS Admin” — The Cloud Nerd on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Does this detect nested group membership?

No. The Admin SDK lists only direct members. You must recursively resolve group-as-member entries, or you'll miss indirect access.

How long after a membership change will it appear in the API?

Changes typically propagate within a minute, but in large domains we've seen delays up to five minutes. Don't rely on immediate consistency.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Audit which third-party apps can read your mail

List every OAuth grant across the domain and find the retired tools still holding access.

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.