Connect Google Workspace
Averil reads your directory, OAuth grants and sign-in events, so it can find former employees with access and apps nobody remembers granting.
What Averil uses it for
- Your directory is the source of truth for who works here. Averil compares it with GitHub, Slack, Railway and the other tools to find people who left but still have access.
- Third-party OAuth grants per user, with their last use, to find stale or risky grants.
- Sign-in successes, failures and suspicious sign-ins.
- 2-Step Verification enrollment for active users.
Read access
Averil uses a service account with domain-wide delegation for read-only Admin SDK scopes, acting as a read-only admin. The broker keeps the key in a key management service and mints short-lived tokens.
| Operation | Scope | Why |
|---|---|---|
| List users | https://www.googleapis.com/auth/admin.directory.user.readonly | Users with suspension, admin and 2-Step Verification status |
| List a user's OAuth grants | https://www.googleapis.com/auth/admin.directory.user.security | Third-party apps each user granted access |
| Read activity | https://www.googleapis.com/auth/admin.reports.audit.readonly | Login and OAuth token events only |
Scopes are wider than the allowlistThe user security scope would also allow deleting grants. The broker allows only listing them. Deleting happens only through the executor, after a person approves.
Write access
| Action | Scope | Verified by | Reversible |
|---|---|---|---|
| Revoke one user's grant to a third-party app | admin.directory.user.security | Listing the user's grants | No |
| Suspend a user who should no longer have access | admin.directory.user | Listing users | Yes |
Revoking a grant cannot be undone by Averil, so the plan says so before you approve it.
How to connect
- 1We give you Averil's service account client ID during onboarding.
- 2A super admin opens the Google Admin console, goes to Security, Access and data control, API controls, Manage domain-wide delegation, and adds the client ID with the three read scopes above.
- 3Choose an admin account with read-only admin privileges for Averil to act as, and tell us which one.
- 4If you have more than one Workspace customer, tell us the customer ID. Otherwise Averil uses your default.
How to revoke
Delete Averil's client ID from Manage domain-wide delegation. Token requests fail from then on, and Averil marks the integration as access revoked.
What's next
Okta, for identity events, is coming soon.
Stuck? Email averil@averil.ai or ask me in Slack.