> ## Documentation Index > Fetch the complete documentation index at: https://docs.tryflare.ai/llms.txt > Use this file to discover all available pages before exploring further. # Google Workspace Audit Logs > Connect read-only login, admin and OAuth-token reports for a verified Workspace customer # Google Workspace audit logs Review unusual sign-ins, administrator changes and third-party OAuth activity. This is separate from the [Google Cloud connector](/connectors/gcp). ## What Flare reads * Reports API activities from **login**, **admin** and **token** applications. * The customer profile needed to verify your customer ID and display domain. * Supported event metadata such as timestamp, actor, action, resource and network information. Flare does not collect Gmail messages, Drive file contents, other Reports applications, a full user directory or data through domain-wide delegation. ## Before connecting Use a Google Workspace administrator with permission to view the required audit reports and customer profile. Locate the **customer ID** (for example, `C01234567`) in Google Admin console → Account → Account settings → Profile. A domain name or email address is not the customer ID. Flare requests these read-only OAuth scopes: * `https://www.googleapis.com/auth/admin.reports.audit.readonly` * `https://www.googleapis.com/auth/admin.directory.customer.readonly` Google has verified Flare’s use of these read-only Workspace scopes. Your organization’s app-access policies must still allow Flare, and the administrator you connect must have access to the required audit reports and customer profile. ## Connect and analyze 1. Open [Connectors](https://tryflare.ai/connectors?audit_provider=google_workspace) and select **Google Workspace**. 2. Enter the customer ID, choose **Connect Google Workspace**, and sign in as the intended administrator. 3. Review and approve the requested read-only access. Flare verifies that the signed-in account belongs to the entered customer and can read all three report applications. 4. Confirm the displayed customer identity, then choose **Run an analysis**. 5. Name the run, select a time window and inspect both findings and the **Google Workspace audit coverage** panel. Google authorization is independent of your Flare sign-in. If Google returns a different customer, reconnect using the intended administrator. A successful empty permission check does not prove that reports contain events. ## Availability and limits These connectors are in early access. The Connectors page shows whether your account can connect and run analyses. During a pause you can still read saved results or disconnect. Each account supports one connection per provider; reconnecting replaces that provider’s connection. Choose a window of up to 30 days. A run retains up to 1,000 unique in-window provider records for analysis across the selected streams. Provider requests have separate page, byte and time limits and may read additional duplicate or out-of-window records. The coverage panel reports the streams read and whether collection was truncated. Available history and reporting delays depend on the provider. An empty result means no events were observed in this query, not that the account had no activity or risk. Only manual runs are supported for this source. Scheduled runs, deploy webhooks and file uploads under this source label are unavailable. Existing GitHub Actions integrations are separate features, not an audit-log collector. ## Troubleshooting | What you see | Next step | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | Source not enabled | Check availability in Connectors or contact [Support](https://tryflare.ai/support). Saved results and disconnect still work. | | Access denied | Confirm provider permissions, organization policy and subscription requirements, then reconnect. | | Scope mismatch | Sign into the account for the customer or organization entered in Flare. Reconnect to change scope. | | No events | Confirm scope and timestamps, allow for provider reporting delay and try a different window. | | Limited coverage | Read the coverage panel; shorten the window to reduce truncation. | | Rate limited | Wait before retrying; avoid repeatedly starting new runs. | | Authorization expired | Reconnect. If permissions were removed, restore them with your administrator first. | | Connection changed | Another reconnect or disconnect superseded this run. Start a fresh analysis. | ## Disconnect and deletion Disconnect removes the encrypted credentials stored in Flare and cancels pending authorization attempts. Existing analyses, selected supporting excerpts and follow-up conversations remain available until deleted. Disconnect is separate from provider-side revocation: remove Flare’s access in the provider’s application settings as well if you want to revoke the grant. Flare projects supported audit metadata before analysis. Selected fields are processed by the AI model; results, selected evidence and frequency baselines support later investigation. Full message, file or repository contents are not collected by these connectors. Review [Privacy](https://tryflare.ai/privacy) or request account deletion through [Support](https://tryflare.ai/support). Never send passwords, OAuth tokens or authorization codes to Support. ## Provider references [Reports API activity list](https://developers.google.com/workspace/admin/reports/reference/rest/v1/activities/list) · [Directory customer lookup](https://developers.google.com/workspace/admin/directory/reference/rest/v1/customers/get)