Posts tagged: #identity

If a Google Workspace super admin is compromised: Admin log events for new admins, role grants, SSO changes, delegation, mail routing and compliance rules.

Domain-wide delegation security risks: how an API client can impersonate every user, the Admin log events that record it, DeleFriend and what to review.

Investigate a suspicious OAuth app in Google Workspace: read token log authorize and activity events, judge Gmail and Drive scopes, revoke and block the app.

Investigate a Google Workspace suspicious login: is_suspicious, hosting ASNs, new countries, impossible travel, failed-login bursts, 2SV and recovery changes.