This article is written for Google Workspace Administrators.

Find Unused Permissions

  1. Sign into xFanatical Foresight.
  2. Go to Settings > Security > Service accounts.
  3. Click the Permissions tab.
  4. Check the list under Granted permissions to Service Account:
    1. Each permission shows a label next to its name: In use, Unused or Pending. The counts are shown at the top right of the list, for example "1 in use, 1 unused".
    2. To see which rules use a permission, click the arrow (⌄) at the right end of its row.
    3. The row expands and shows Used by rules: with the rule names, or Not used by any enabled rule.
  5. If any permission is unused, a yellow box appears at the top of the tab: Unused permissions. Consider revoking. We recommend removing these permissions.
    1. In that box, click View more (next to the permission names).
    2. The Review unused scopes dialog opens and shows each unused permission with its details.
    3. Click Close when you're done.
  6. Click the Domain wide delegation tab, next to the Permissions tab.
  7. In the Setting Details box, click Copy next to Client ID. You'll need it in the next section to find the service account in Google Admin Console.

Remove a Permission in Google Admin Console

You must be a Google Workspace Super Admin to complete this task.

  1. Sign into Google Admin Console.
  2. Go to Security > Access and data control > API controls > Domain wide delegation.
  3. Find the client with the Client ID of your service account above, and click Edit.
  4. Delete the scopes you no longer need from the OAuth scopes field.
  5. Click Authorize.