​

Google Workspace audit logs

Review unusual sign-ins, administrator changes and third-party OAuth activity. This is separate from the Google Cloud connector.

​

What Flare reads

• Reports API activities from login, admin and token applications.
• The customer profile needed to verify your customer ID and display domain.
• Supported event metadata such as timestamp, actor, action, resource and network information.

Flare does not collect Gmail messages, Drive file contents, other Reports applications, a full user directory or data through domain-wide delegation.

​

Before connecting

Use a Google Workspace administrator with permission to view the required audit reports and customer profile. Locate the customer ID (for example, C01234567) in Google Admin console → Account → Account settings → Profile. A domain name or email address is not the customer ID. Flare requests these read-only OAuth scopes:

• https://www.googleapis.com/auth/admin.reports.audit.readonly
• https://www.googleapis.com/auth/admin.directory.customer.readonly

Google has verified Flare’s use of these read-only Workspace scopes. Your organization’s app-access policies must still allow Flare, and the administrator you connect must have access to the required audit reports and customer profile.

​

Connect and analyze

1. Open Connectors and select Google Workspace.
2. Enter the customer ID, choose Connect Google Workspace, and sign in as the intended administrator.
3. Review and approve the requested read-only access. Flare verifies that the signed-in account belongs to the entered customer and can read all three report applications.
4. Confirm the displayed customer identity, then choose Run an analysis.
5. Name the run, select a time window and inspect both findings and the Google Workspace audit coverage panel.

Google authorization is independent of your Flare sign-in. If Google returns a different customer, reconnect using the intended administrator. A successful empty permission check does not prove that reports contain events.

​

Availability and limits

These connectors are in early access. The Connectors page shows whether your account can connect and run analyses. During a pause you can still read saved results or disconnect. Each account supports one connection per provider; reconnecting replaces that provider’s connection. Choose a window of up to 30 days. A run retains up to 1,000 unique in-window provider records for analysis across the selected streams. Provider requests have separate page, byte and time limits and may read additional duplicate or out-of-window records. The coverage panel reports the streams read and whether collection was truncated. Available history and reporting delays depend on the provider. An empty result means no events were observed in this query, not that the account had no activity or risk. Only manual runs are supported for this source. Scheduled runs, deploy webhooks and file uploads under this source label are unavailable. Existing GitHub Actions integrations are separate features, not an audit-log collector.

​

Troubleshooting

​

Disconnect and deletion

Disconnect removes the encrypted credentials stored in Flare and cancels pending authorization attempts. Existing analyses, selected supporting excerpts and follow-up conversations remain available until deleted. Disconnect is separate from provider-side revocation: remove Flare’s access in the provider’s application settings as well if you want to revoke the grant. Flare projects supported audit metadata before analysis. Selected fields are processed by the AI model; results, selected evidence and frequency baselines support later investigation. Full message, file or repository contents are not collected by these connectors. Review Privacy or request account deletion through Support. Never send passwords, OAuth tokens or authorization codes to Support.

​

Provider references

Reports API activity list · Directory customer lookup