Skip to content
Workspace Forensics

This tool is not affiliated with, endorsed by or sponsored by Google LLC. Google Workspace, Gmail and Google Drive are trademarks of Google LLC. Other names are trademarks of their respective owners.

Glossary

Domain-wide delegation

A Google Workspace setting that lets a service account or API client act as any user in the domain for listed scopes, without user consent.

Domain-wide delegation (DWD) lets a service account or API client impersonate any user in a Google Workspace domain for the OAuth scopes a super admin lists under Security → API controls → Manage Domain Wide Delegation. No end-user consent is involved.

It powers backup, migration and admin tools, and it is high-value persistence for an attacker. New delegations are logged in the Admin log as AUTHORIZE_API_CLIENT_ACCESS. The 2023 DeleFriend research showed that Google Cloud permission to create keys for a delegated service account is enough to reuse its delegation.

See: domain-wide delegation security risks and Google's DWD documentation.

This tool is not affiliated with, endorsed by or sponsored by Google LLC. Google Workspace, Gmail and Google Drive are trademarks of Google LLC. Other names are trademarks of their respective owners.