GWS Admin: Privilege Modification

Christopher Scott@Scocha

•updated Aug 8, 2026•0•0•3

This rule detects modifications to administrative privileges in Google Workspace, including granting or revoking administrative roles and delegating administrative responsibilities. Such activities are critical security events that could indicate unauthorized privilege escalation, account compromise, or malicious administrative activity.