3 ms·
If your're on a paid plan it's pretty trivial for superadmins to read your mail. It's logged, but they can.
by agentdrtran 4y ago
If your're on a paid plan it's pretty trivial for superadmins to read your mail. It's logged, but they can.
- spacehunt 4y agoIt's really easy to impersonate any user using domain wide delegation, and subsequent accesses aren't logged. https://developers.google.com/admin-sdk/directory/v1/guides/delegation https://developers.google.com/admin-sdk/directory/v1/guides/...
- agentdrtran 4y agoYeah, it's not great. We had to add logging into our custom app to get around this. The only thing you'll see in logs when adding a delegate is the OAuth log entry for Gmail, which doesn't tell you a lot. As far as I can tell, adding a delegate or forward isn't even logged anywhere, and being able to see what a delegate is doing was added as a feature only a few months ago: https://workspaceupdates.googleblog.com/2022/03/gmail-delegate-logging-security-investigation-tool.html https://workspaceupdates.googleblog.com/2022/03/gmail-delega...