Permission
What it returns
Why we need it
admin.directory.user.readonly
User accounts, org units and suspension state
So we can tell who exists and who is suspended
admin.directory.domain.readonly
Domains attached to the workspace
To scope the report to your organization
apps.licensing
Assigned SKUs and license counts
So we know what is bought and what is assigned
admin.reports.audit.readonly
Login activity timestamps
So we can identify dormant accounts. No message data.
admin.reports.usage.readonly
Per-user product usage counters
So we can spot people who never use what they pay for
admin.directory.user.security
Third-party OAuth tokens issued by your users
So we can surface shadow apps