domainwidedelegation.comGet it set up

Use cases → Admin and governance

Produce a monthly security report of admin actions

Aggregate all admin actions across the domain into a monthly report by querying the audit logs with a delegated service account.

Who it is forSecurity and compliance teams responsible for oversight of admin activity in Google Workspace.
APIsAdmin SDK
Typical scopesadmin.reports.audit.readonly

The problem

Every admin action — from user creation to privilege changes — is logged, but reviewing them is tedious and error-prone without automation. Manual spot checks miss patterns, and native alerting is too coarse for real oversight.

How it works

  1. A delegated service account queries the Reports API for the 'admin' activity type over the last calendar month.
  2. Actions are grouped by actor, action type, and target for easier review.
  3. The data is exported to a spreadsheet or dashboard for security review.
  4. A summary of high-risk actions (role changes, external sharing, MFA resets) is highlighted.
  5. The report is distributed to designated reviewers each month.

What changes

Admin activity is visible in one place, with trends and anomalies surfaced for review, instead of buried in raw logs.

The trap in this one. The Reports API has propagation delays of several hours, and actions in the last day of the month may not appear when the report is run. If you schedule the job for midnight on the first, your numbers will silently miss late actions — and you will not see the gap unless you re-query with overlap or compare raw event counts.

Watch it explained

“Automate Google Sheets with Apps Script” — Matas Valincius on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Can I include actions from delegated admin roles?

Yes, the Admin SDK audit logs record all admin actions, including those from delegated roles, as long as they are performed through the Admin console or API.

How far back can I query audit logs?

The retention period depends on your Workspace edition, but most allow at least six months. Always check the API documentation for your edition's exact retention.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Audit which third-party apps can read your mail

List every OAuth grant across the domain and find the retired tools still holding access.

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.