Admin Audit Activity Events - Delegated Admin Settings

    This document lists the events and parameters for Delegated Admin Settings Admin Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=admin .

    Delegated Admin Settings

    Events of this type are returned with type=DELEGATED_ADMIN_SETTINGS .

    Role Assign

    Event details
    Event name
    ASSIGN_ROLE
    Parameters
    ORG_ UNIT_ NAME

    string

    The organizational unit (OU) name (path).

    ROLE_ NAME

    string

    The role name for this privilege that is assigned to USER_NAME . A delegated administrator's role is granted by the super administrator. See note for restrictions. Possible values:

    • _AFFILIATE_ADMIN_ROLE
      Affiliate admin role value.
    • _DAR_NETWORK_MANAGEMENT_ROLE
      Indirect Reseller Network Admin role value.
    • _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE
      Indirect Reseller Resold Customer Admin role value.
    • _DEGRADED_AFFILIATE_ADMIN_ROLE
      Degraded Affiliate admin role value.
    • _DIRECTORY_SYNC_ADMIN_ROLE
    • _DOMAINLESS_SUPER_ADMIN_ROLE
    • _DRIVE_TEAM_ADMIN_ROLE
    • _GOOGLE_VOICE_ADMIN_ROLE
    • _GROUPS_ADMIN_ROLE
    • _GROUPS_EDITOR_ROLE
      Display Name for Groups Editor Role in Admin Console.
    • _GROUPS_READER_ROLE
      Display Name for Groups Reader Role in Admin Console.
    • _HELP_DESK_ADMIN_ROLE
    • _INVENTORY_REPORTING_ADMIN_ROLE
    • _LDAP_GROUP_MANAGEMENT_READONLY_ROLE
    • _LDAP_PASSWORD_REBIND_ROLE
    • _LDAP_USER_MANAGEMENT_READONLY_ROLE
    • _LEGACY_ENTERPRISE_SUPPORT_ROLE
      Legacy Enterprise Support Role value.
    • _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE
      Legacy Resold Enterprise Support Role value.
    • _MOBILE_ADMIN_ROLE
    • _PLAY_FOR_WORK_ADMIN_ROLE
    • _RESELLER_ADMIN_ROLE
    • _SEED_ADMIN_ROLE
    • _SERVICE_ADMIN_ROLE
    • _STORAGE_ADMIN_ROLE
    • _TEAM_ADMIN_ROLE
    • _USER_MANAGEMENT_ADMIN_ROLE
    USER_ EMAIL

    string

    The primary email address of the delegated administrator assigned the role. For more information about delegated administrator roles, see the administration help center .

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= ASSIGN_ROLE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Role {ROLE_NAME} assigned to user {USER_EMAIL}

    Role Creation

    Event details
    Event name
    CREATE_ROLE
    Parameters
    ROLE_ ID

    string

    Unique identifier for this privilege. A delegated administrator's role is granted by the super administrator. See note for restrictions.

    ROLE_ NAME

    string

    The new role name. See note for restrictions. For more information about delegated administrator roles, see the administration help center . Possible values:

    • _AFFILIATE_ADMIN_ROLE
      Affiliate admin role value.
    • _DAR_NETWORK_MANAGEMENT_ROLE
      Indirect Reseller Network Admin role value.
    • _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE
      Indirect Reseller Resold Customer Admin role value.
    • _DEGRADED_AFFILIATE_ADMIN_ROLE
      Degraded Affiliate admin role value.
    • _DIRECTORY_SYNC_ADMIN_ROLE
    • _DOMAINLESS_SUPER_ADMIN_ROLE
    • _DRIVE_TEAM_ADMIN_ROLE
    • _GOOGLE_VOICE_ADMIN_ROLE
    • _GROUPS_ADMIN_ROLE
    • _GROUPS_EDITOR_ROLE
      Display Name for Groups Editor Role in Admin Console.
    • _GROUPS_READER_ROLE
      Display Name for Groups Reader Role in Admin Console.
    • _HELP_DESK_ADMIN_ROLE
    • _INVENTORY_REPORTING_ADMIN_ROLE
    • _LDAP_GROUP_MANAGEMENT_READONLY_ROLE
    • _LDAP_PASSWORD_REBIND_ROLE
    • _LDAP_USER_MANAGEMENT_READONLY_ROLE
    • _LEGACY_ENTERPRISE_SUPPORT_ROLE
      Legacy Enterprise Support Role value.
    • _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE
      Legacy Resold Enterprise Support Role value.
    • _MOBILE_ADMIN_ROLE
    • _PLAY_FOR_WORK_ADMIN_ROLE
    • _RESELLER_ADMIN_ROLE
    • _SEED_ADMIN_ROLE
    • _SERVICE_ADMIN_ROLE
    • _STORAGE_ADMIN_ROLE
    • _TEAM_ADMIN_ROLE
    • _USER_MANAGEMENT_ADMIN_ROLE
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= CREATE_ROLE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    New role {ROLE_NAME} created

    Role Deletion

    Event details
    Event name
    DELETE_ROLE
    Parameters
    ROLE_ ID

    string

    Unique identifier for this privilege. A delegated administrator's role is granted by the super administrator. See note for restrictions.

    ROLE_ NAME

    string

    The role was deleted for this ROLE_NAME . See note for restrictions. For more information about delegated administrator roles, see the administration help center . Possible values:

    • _AFFILIATE_ADMIN_ROLE
      Affiliate admin role value.
    • _DAR_NETWORK_MANAGEMENT_ROLE
      Indirect Reseller Network Admin role value.
    • _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE
      Indirect Reseller Resold Customer Admin role value.
    • _DEGRADED_AFFILIATE_ADMIN_ROLE
      Degraded Affiliate admin role value.
    • _DIRECTORY_SYNC_ADMIN_ROLE
    • _DOMAINLESS_SUPER_ADMIN_ROLE
    • _DRIVE_TEAM_ADMIN_ROLE
    • _GOOGLE_VOICE_ADMIN_ROLE
    • _GROUPS_ADMIN_ROLE
    • _GROUPS_EDITOR_ROLE
      Display Name for Groups Editor Role in Admin Console.
    • _GROUPS_READER_ROLE
      Display Name for Groups Reader Role in Admin Console.
    • _HELP_DESK_ADMIN_ROLE
    • _INVENTORY_REPORTING_ADMIN_ROLE
    • _LDAP_GROUP_MANAGEMENT_READONLY_ROLE
    • _LDAP_PASSWORD_REBIND_ROLE
    • _LDAP_USER_MANAGEMENT_READONLY_ROLE
    • _LEGACY_ENTERPRISE_SUPPORT_ROLE
      Legacy Enterprise Support Role value.
    • _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE
      Legacy Resold Enterprise Support Role value.
    • _MOBILE_ADMIN_ROLE
    • _PLAY_FOR_WORK_ADMIN_ROLE
    • _RESELLER_ADMIN_ROLE
    • _SEED_ADMIN_ROLE
    • _SERVICE_ADMIN_ROLE
    • _STORAGE_ADMIN_ROLE
    • _TEAM_ADMIN_ROLE
    • _USER_MANAGEMENT_ADMIN_ROLE
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= DELETE_ROLE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Role {ROLE_NAME} deleted

    Role Privilege Creation

    Event details
    Event name
    ADD_PRIVILEGE
    Parameters
    PRIVILEGE_ NAME

    string

    The new privilege name which has been added to the ROLE_NAME . Granted to a delegated administrator by a super administrator. For more information about delegated administrator privileges, see the administration help center .

    ROLE_ ID

    string

    Unique identifier for this privilege. A delegated administrator's role is granted by the super administrator. See note for restrictions.

    ROLE_ NAME

    string

    The new PRIVILEGE_NAME added to this ROLE_NAME . See note for restrictions. Possible values:

    • _AFFILIATE_ADMIN_ROLE
      Affiliate admin role value.
    • _DAR_NETWORK_MANAGEMENT_ROLE
      Indirect Reseller Network Admin role value.
    • _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE
      Indirect Reseller Resold Customer Admin role value.
    • _DEGRADED_AFFILIATE_ADMIN_ROLE
      Degraded Affiliate admin role value.
    • _DIRECTORY_SYNC_ADMIN_ROLE
    • _DOMAINLESS_SUPER_ADMIN_ROLE
    • _DRIVE_TEAM_ADMIN_ROLE
    • _GOOGLE_VOICE_ADMIN_ROLE
    • _GROUPS_ADMIN_ROLE
    • _GROUPS_EDITOR_ROLE
      Display Name for Groups Editor Role in Admin Console.
    • _GROUPS_READER_ROLE
      Display Name for Groups Reader Role in Admin Console.
    • _HELP_DESK_ADMIN_ROLE
    • _INVENTORY_REPORTING_ADMIN_ROLE
    • _LDAP_GROUP_MANAGEMENT_READONLY_ROLE
    • _LDAP_PASSWORD_REBIND_ROLE
    • _LDAP_USER_MANAGEMENT_READONLY_ROLE
    • _LEGACY_ENTERPRISE_SUPPORT_ROLE
      Legacy Enterprise Support Role value.
    • _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE
      Legacy Resold Enterprise Support Role value.
    • _MOBILE_ADMIN_ROLE
    • _PLAY_FOR_WORK_ADMIN_ROLE
    • _RESELLER_ADMIN_ROLE
    • _SEED_ADMIN_ROLE
    • _SERVICE_ADMIN_ROLE
    • _STORAGE_ADMIN_ROLE
    • _TEAM_ADMIN_ROLE
    • _USER_MANAGEMENT_ADMIN_ROLE
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= ADD_PRIVILEGE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    New privilege {PRIVILEGE_NAME} created under role {ROLE_NAME}

    Role Privilege Deletion

    Event details
    Event name
    REMOVE_PRIVILEGE
    Parameters
    PRIVILEGE_ NAME

    string

    Removed this privilege name from ROLE_NAME . Granted to a delegated administrator by a super administrator. For more information about delegated administrator privileges, see the administration help center .

    ROLE_ ID

    string

    Unique identifier for this privilege. A delegated administrator's role is granted by the super administrator. See note for restrictions.

    ROLE_ NAME

    string

    The role from which the privilege was removed. See note for restrictions. Possible values:

    • _AFFILIATE_ADMIN_ROLE
      Affiliate admin role value.
    • _DAR_NETWORK_MANAGEMENT_ROLE
      Indirect Reseller Network Admin role value.
    • _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE
      Indirect Reseller Resold Customer Admin role value.
    • _DEGRADED_AFFILIATE_ADMIN_ROLE
      Degraded Affiliate admin role value.
    • _DIRECTORY_SYNC_ADMIN_ROLE
    • _DOMAINLESS_SUPER_ADMIN_ROLE
    • _DRIVE_TEAM_ADMIN_ROLE
    • _GOOGLE_VOICE_ADMIN_ROLE
    • _GROUPS_ADMIN_ROLE
    • _GROUPS_EDITOR_ROLE
      Display Name for Groups Editor Role in Admin Console.
    • _GROUPS_READER_ROLE
      Display Name for Groups Reader Role in Admin Console.
    • _HELP_DESK_ADMIN_ROLE
    • _INVENTORY_REPORTING_ADMIN_ROLE
    • _LDAP_GROUP_MANAGEMENT_READONLY_ROLE
    • _LDAP_PASSWORD_REBIND_ROLE
    • _LDAP_USER_MANAGEMENT_READONLY_ROLE
    • _LEGACY_ENTERPRISE_SUPPORT_ROLE
      Legacy Enterprise Support Role value.
    • _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE
      Legacy Resold Enterprise Support Role value.
    • _MOBILE_ADMIN_ROLE
    • _PLAY_FOR_WORK_ADMIN_ROLE
    • _RESELLER_ADMIN_ROLE
    • _SEED_ADMIN_ROLE
    • _SERVICE_ADMIN_ROLE
    • _STORAGE_ADMIN_ROLE
    • _TEAM_ADMIN_ROLE
    • _USER_MANAGEMENT_ADMIN_ROLE
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= REMOVE_PRIVILEGE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Privilege {PRIVILEGE_NAME} removed from role {ROLE_NAME}

    Role Rename

    Event details
    Event name
    RENAME_ROLE
    Parameters
    NEW_ VALUE

    string

    The new role name.

    ROLE_ NAME

    string

    The old role name that is being renamed. For more information about delegated administrator privileges, see the administration help center . Possible values:

    • _AFFILIATE_ADMIN_ROLE
      Affiliate admin role value.
    • _DAR_NETWORK_MANAGEMENT_ROLE
      Indirect Reseller Network Admin role value.
    • _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE
      Indirect Reseller Resold Customer Admin role value.
    • _DEGRADED_AFFILIATE_ADMIN_ROLE
      Degraded Affiliate admin role value.
    • _DIRECTORY_SYNC_ADMIN_ROLE
    • _DOMAINLESS_SUPER_ADMIN_ROLE
    • _DRIVE_TEAM_ADMIN_ROLE
    • _GOOGLE_VOICE_ADMIN_ROLE
    • _GROUPS_ADMIN_ROLE
    • _GROUPS_EDITOR_ROLE
      Display Name for Groups Editor Role in Admin Console.
    • _GROUPS_READER_ROLE
      Display Name for Groups Reader Role in Admin Console.
    • _HELP_DESK_ADMIN_ROLE
    • _INVENTORY_REPORTING_ADMIN_ROLE
    • _LDAP_GROUP_MANAGEMENT_READONLY_ROLE
    • _LDAP_PASSWORD_REBIND_ROLE
    • _LDAP_USER_MANAGEMENT_READONLY_ROLE
    • _LEGACY_ENTERPRISE_SUPPORT_ROLE
      Legacy Enterprise Support Role value.
    • _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE
      Legacy Resold Enterprise Support Role value.
    • _MOBILE_ADMIN_ROLE
    • _PLAY_FOR_WORK_ADMIN_ROLE
    • _RESELLER_ADMIN_ROLE
    • _SEED_ADMIN_ROLE
    • _SERVICE_ADMIN_ROLE
    • _STORAGE_ADMIN_ROLE
    • _TEAM_ADMIN_ROLE
    • _USER_MANAGEMENT_ADMIN_ROLE
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= RENAME_ROLE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Role renamed from {ROLE_NAME} to {NEW_VALUE}

    Role Updated

    Event details
    Event name
    UPDATE_ROLE
    Parameters
    ROLE_ ID

    string

    Unique identifier for this privilege. A delegated administrator's role is granted by the super administrator. See note for restrictions.

    ROLE_ NAME

    string

    The name of the new role to apply. For more information about delegated administrator roles, see the administration help center . Possible values:

    • _AFFILIATE_ADMIN_ROLE
      Affiliate admin role value.
    • _DAR_NETWORK_MANAGEMENT_ROLE
      Indirect Reseller Network Admin role value.
    • _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE
      Indirect Reseller Resold Customer Admin role value.
    • _DEGRADED_AFFILIATE_ADMIN_ROLE
      Degraded Affiliate admin role value.
    • _DIRECTORY_SYNC_ADMIN_ROLE
    • _DOMAINLESS_SUPER_ADMIN_ROLE
    • _DRIVE_TEAM_ADMIN_ROLE
    • _GOOGLE_VOICE_ADMIN_ROLE
    • _GROUPS_ADMIN_ROLE
    • _GROUPS_EDITOR_ROLE
      Display Name for Groups Editor Role in Admin Console.
    • _GROUPS_READER_ROLE
      Display Name for Groups Reader Role in Admin Console.
    • _HELP_DESK_ADMIN_ROLE
    • _INVENTORY_REPORTING_ADMIN_ROLE
    • _LDAP_GROUP_MANAGEMENT_READONLY_ROLE
    • _LDAP_PASSWORD_REBIND_ROLE
    • _LDAP_USER_MANAGEMENT_READONLY_ROLE
    • _LEGACY_ENTERPRISE_SUPPORT_ROLE
      Legacy Enterprise Support Role value.
    • _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE
      Legacy Resold Enterprise Support Role value.
    • _MOBILE_ADMIN_ROLE
    • _PLAY_FOR_WORK_ADMIN_ROLE
    • _RESELLER_ADMIN_ROLE
    • _SEED_ADMIN_ROLE
    • _SERVICE_ADMIN_ROLE
    • _STORAGE_ADMIN_ROLE
    • _TEAM_ADMIN_ROLE
    • _USER_MANAGEMENT_ADMIN_ROLE
    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UPDATE_ROLE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Role {ROLE_NAME} updated

    Unassign Role

    Event details
    Event name
    UNASSIGN_ROLE
    Parameters
    ORG_ UNIT_ NAME

    string

    The organizational unit (OU) name (path).

    ROLE_ NAME

    string

    Role name that is being unassigned from USER_EMAIL . A delegated administrator's role is granted by the super administrator. See note for restrictions. Possible values:

    • _AFFILIATE_ADMIN_ROLE
      Affiliate admin role value.
    • _DAR_NETWORK_MANAGEMENT_ROLE
      Indirect Reseller Network Admin role value.
    • _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE
      Indirect Reseller Resold Customer Admin role value.
    • _DEGRADED_AFFILIATE_ADMIN_ROLE
      Degraded Affiliate admin role value.
    • _DIRECTORY_SYNC_ADMIN_ROLE
    • _DOMAINLESS_SUPER_ADMIN_ROLE
    • _DRIVE_TEAM_ADMIN_ROLE
    • _GOOGLE_VOICE_ADMIN_ROLE
    • _GROUPS_ADMIN_ROLE
    • _GROUPS_EDITOR_ROLE
      Display Name for Groups Editor Role in Admin Console.
    • _GROUPS_READER_ROLE
      Display Name for Groups Reader Role in Admin Console.
    • _HELP_DESK_ADMIN_ROLE
    • _INVENTORY_REPORTING_ADMIN_ROLE
    • _LDAP_GROUP_MANAGEMENT_READONLY_ROLE
    • _LDAP_PASSWORD_REBIND_ROLE
    • _LDAP_USER_MANAGEMENT_READONLY_ROLE
    • _LEGACY_ENTERPRISE_SUPPORT_ROLE
      Legacy Enterprise Support Role value.
    • _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE
      Legacy Resold Enterprise Support Role value.
    • _MOBILE_ADMIN_ROLE
    • _PLAY_FOR_WORK_ADMIN_ROLE
    • _RESELLER_ADMIN_ROLE
    • _SEED_ADMIN_ROLE
    • _SERVICE_ADMIN_ROLE
    • _STORAGE_ADMIN_ROLE
    • _TEAM_ADMIN_ROLE
    • _USER_MANAGEMENT_ADMIN_ROLE
    USER_ EMAIL

    string

    The delegated administrator's primary email address. The role is being unassigned from this user. For more information about delegated administrator roles, see the administration help center .

    Sample request
    GET https://admin.googleapis.com /admin /reports /v1 /activity /users /all /applications / admin ?eventName= UNASSIGN_ROLE &maxResults=10 &access_token= YOUR_ACCESS_TOKEN
    Admin Console message format
    Unassigned role {ROLE_NAME} from user {USER_EMAIL}
    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: