domainwidedelegation.comStart free

Use cases → Admin and governance

Monitor Workspace user account activity via delegation

Track login, email, and document activity across all users in a domain using a delegated service account, with daily or real-time reporting.

Who it is forIT administrators and security teams responsible for Workspace compliance and incident response.
APIsAdmin SDK, Gmail API, Drive API
Typical scopesadmin.reports.audit.readonly, gmail.readonly, drive.readonly

The problem

User activity—logins, file access, and mailbox actions—must be monitored for compliance, security, and troubleshooting. Manual checks miss anomalies, and relying on user reports is too slow for real incidents.

How it works

  1. Use domain-wide delegation to impersonate an admin and call the Admin Reports API for login and account activity.
  2. Supplement with Gmail and Drive APIs under delegation to fetch mailbox and file access events where the audit log is insufficient.
  3. Aggregate activity records by user and time window.
  4. Generate daily or real-time alerts for suspicious or policy-violating activity.

What changes

Activity is tracked centrally, with evidence available for investigations and compliance audits. Alerts surface issues before they escalate.

The trap in this one. The Admin Reports API can lag by several hours and occasionally omits events if the target user's primary email address changes between the event and retrieval. This silent omission means a user rename or alias swap can result in missing audit records with no explicit error or warning. Always cross-reference user IDs, not just email addresses, and expect gaps around rename events.

Watch it explained

“GAT+ | Google Workspace Users Activity Events” — GAT Labs on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Does this capture third-party app activity?

Only if the app's actions are surfaced through Google's audit logs. Many OAuth or SAML events are present, but not all third-party actions are tracked.

How far back can I retrieve activity?

The Admin Reports API retains most audit data for 6 months, but some event types have shorter retention. Pull data regularly to avoid loss.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.

Reduce an over-broad delegation grant safely

Find out which scopes your automation genuinely uses, then cut the grant down to them.