Admin Audit Activity Events - Delegated Admin Settings

This document lists the events and parameters for Delegated Admin Settings Admin Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=admin.

Delegated Admin Settings

Events of this type are returned with type=DELEGATED_ADMIN_SETTINGS.

Role Assign

Event details
Event name	ASSIGN_ROLE
Parameters	ORG_UNIT_NAME string The organizational unit (OU) name (path). ROLE_NAME string The role name for this privilege that is assigned to USER_NAME. A delegated administrator's role is granted by the super administrator. See note for restrictions. Possible values: _AFFILIATE_ADMIN_ROLE Affiliate admin role value. _DAR_NETWORK_MANAGEMENT_ROLE Indirect Reseller Network Admin role value. _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE Indirect Reseller Resold Customer Admin role value. _DEGRADED_AFFILIATE_ADMIN_ROLE Degraded Affiliate admin role value. _DIRECTORY_SYNC_ADMIN_ROLE _DOMAINLESS_SUPER_ADMIN_ROLE _DRIVE_TEAM_ADMIN_ROLE _GOOGLE_VOICE_ADMIN_ROLE _GROUPS_ADMIN_ROLE _GROUPS_EDITOR_ROLE Display Name for Groups Editor Role in Admin Console. _GROUPS_READER_ROLE Display Name for Groups Reader Role in Admin Console. _HELP_DESK_ADMIN_ROLE _INVENTORY_REPORTING_ADMIN_ROLE _LDAP_GROUP_MANAGEMENT_READONLY_ROLE _LDAP_PASSWORD_REBIND_ROLE _LDAP_USER_MANAGEMENT_READONLY_ROLE _LEGACY_ENTERPRISE_SUPPORT_ROLE Legacy Enterprise Support Role value. _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE Legacy Resold Enterprise Support Role value. _MOBILE_ADMIN_ROLE _PLAY_FOR_WORK_ADMIN_ROLE _RESELLER_ADMIN_ROLE _SEED_ADMIN_ROLE _SERVICE_ADMIN_ROLE _STORAGE_ADMIN_ROLE _TEAM_ADMIN_ROLE _USER_MANAGEMENT_ADMIN_ROLE USER_EMAIL string The primary email address of the delegated administrator assigned the role. For more information about delegated administrator roles, see the administration help center.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ASSIGN_ROLE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Role {ROLE_NAME} assigned to user {USER_EMAIL}

Role Creation

Event details
Event name	CREATE_ROLE
Parameters	ROLE_ID string Unique identifier for this privilege. A delegated administrator's role is granted by the super administrator. See note for restrictions. ROLE_NAME string The new role name. See note for restrictions. For more information about delegated administrator roles, see the administration help center. Possible values: _AFFILIATE_ADMIN_ROLE Affiliate admin role value. _DAR_NETWORK_MANAGEMENT_ROLE Indirect Reseller Network Admin role value. _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE Indirect Reseller Resold Customer Admin role value. _DEGRADED_AFFILIATE_ADMIN_ROLE Degraded Affiliate admin role value. _DIRECTORY_SYNC_ADMIN_ROLE _DOMAINLESS_SUPER_ADMIN_ROLE _DRIVE_TEAM_ADMIN_ROLE _GOOGLE_VOICE_ADMIN_ROLE _GROUPS_ADMIN_ROLE _GROUPS_EDITOR_ROLE Display Name for Groups Editor Role in Admin Console. _GROUPS_READER_ROLE Display Name for Groups Reader Role in Admin Console. _HELP_DESK_ADMIN_ROLE _INVENTORY_REPORTING_ADMIN_ROLE _LDAP_GROUP_MANAGEMENT_READONLY_ROLE _LDAP_PASSWORD_REBIND_ROLE _LDAP_USER_MANAGEMENT_READONLY_ROLE _LEGACY_ENTERPRISE_SUPPORT_ROLE Legacy Enterprise Support Role value. _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE Legacy Resold Enterprise Support Role value. _MOBILE_ADMIN_ROLE _PLAY_FOR_WORK_ADMIN_ROLE _RESELLER_ADMIN_ROLE _SEED_ADMIN_ROLE _SERVICE_ADMIN_ROLE _STORAGE_ADMIN_ROLE _TEAM_ADMIN_ROLE _USER_MANAGEMENT_ADMIN_ROLE
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=CREATE_ROLE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	New role {ROLE_NAME} created

Role Deletion

Event details
Event name	DELETE_ROLE
Parameters	ROLE_ID string Unique identifier for this privilege. A delegated administrator's role is granted by the super administrator. See note for restrictions. ROLE_NAME string The role was deleted for this ROLE_NAME. See note for restrictions. For more information about delegated administrator roles, see the administration help center. Possible values: _AFFILIATE_ADMIN_ROLE Affiliate admin role value. _DAR_NETWORK_MANAGEMENT_ROLE Indirect Reseller Network Admin role value. _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE Indirect Reseller Resold Customer Admin role value. _DEGRADED_AFFILIATE_ADMIN_ROLE Degraded Affiliate admin role value. _DIRECTORY_SYNC_ADMIN_ROLE _DOMAINLESS_SUPER_ADMIN_ROLE _DRIVE_TEAM_ADMIN_ROLE _GOOGLE_VOICE_ADMIN_ROLE _GROUPS_ADMIN_ROLE _GROUPS_EDITOR_ROLE Display Name for Groups Editor Role in Admin Console. _GROUPS_READER_ROLE Display Name for Groups Reader Role in Admin Console. _HELP_DESK_ADMIN_ROLE _INVENTORY_REPORTING_ADMIN_ROLE _LDAP_GROUP_MANAGEMENT_READONLY_ROLE _LDAP_PASSWORD_REBIND_ROLE _LDAP_USER_MANAGEMENT_READONLY_ROLE _LEGACY_ENTERPRISE_SUPPORT_ROLE Legacy Enterprise Support Role value. _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE Legacy Resold Enterprise Support Role value. _MOBILE_ADMIN_ROLE _PLAY_FOR_WORK_ADMIN_ROLE _RESELLER_ADMIN_ROLE _SEED_ADMIN_ROLE _SERVICE_ADMIN_ROLE _STORAGE_ADMIN_ROLE _TEAM_ADMIN_ROLE _USER_MANAGEMENT_ADMIN_ROLE
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=DELETE_ROLE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Role {ROLE_NAME} deleted

Role Privilege Creation

Event details
Event name	ADD_PRIVILEGE
Parameters	PRIVILEGE_NAME string The new privilege name which has been added to the ROLE_NAME. Granted to a delegated administrator by a super administrator. For more information about delegated administrator privileges, see the administration help center. ROLE_ID string Unique identifier for this privilege. A delegated administrator's role is granted by the super administrator. See note for restrictions. ROLE_NAME string The new PRIVILEGE_NAME added to this ROLE_NAME. See note for restrictions. Possible values: _AFFILIATE_ADMIN_ROLE Affiliate admin role value. _DAR_NETWORK_MANAGEMENT_ROLE Indirect Reseller Network Admin role value. _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE Indirect Reseller Resold Customer Admin role value. _DEGRADED_AFFILIATE_ADMIN_ROLE Degraded Affiliate admin role value. _DIRECTORY_SYNC_ADMIN_ROLE _DOMAINLESS_SUPER_ADMIN_ROLE _DRIVE_TEAM_ADMIN_ROLE _GOOGLE_VOICE_ADMIN_ROLE _GROUPS_ADMIN_ROLE _GROUPS_EDITOR_ROLE Display Name for Groups Editor Role in Admin Console. _GROUPS_READER_ROLE Display Name for Groups Reader Role in Admin Console. _HELP_DESK_ADMIN_ROLE _INVENTORY_REPORTING_ADMIN_ROLE _LDAP_GROUP_MANAGEMENT_READONLY_ROLE _LDAP_PASSWORD_REBIND_ROLE _LDAP_USER_MANAGEMENT_READONLY_ROLE _LEGACY_ENTERPRISE_SUPPORT_ROLE Legacy Enterprise Support Role value. _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE Legacy Resold Enterprise Support Role value. _MOBILE_ADMIN_ROLE _PLAY_FOR_WORK_ADMIN_ROLE _RESELLER_ADMIN_ROLE _SEED_ADMIN_ROLE _SERVICE_ADMIN_ROLE _STORAGE_ADMIN_ROLE _TEAM_ADMIN_ROLE _USER_MANAGEMENT_ADMIN_ROLE
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=ADD_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	New privilege {PRIVILEGE_NAME} created under role {ROLE_NAME}

Role Privilege Deletion

Event details
Event name	REMOVE_PRIVILEGE
Parameters	PRIVILEGE_NAME string Removed this privilege name from ROLE_NAME. Granted to a delegated administrator by a super administrator. For more information about delegated administrator privileges, see the administration help center. ROLE_ID string Unique identifier for this privilege. A delegated administrator's role is granted by the super administrator. See note for restrictions. ROLE_NAME string The role from which the privilege was removed. See note for restrictions. Possible values: _AFFILIATE_ADMIN_ROLE Affiliate admin role value. _DAR_NETWORK_MANAGEMENT_ROLE Indirect Reseller Network Admin role value. _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE Indirect Reseller Resold Customer Admin role value. _DEGRADED_AFFILIATE_ADMIN_ROLE Degraded Affiliate admin role value. _DIRECTORY_SYNC_ADMIN_ROLE _DOMAINLESS_SUPER_ADMIN_ROLE _DRIVE_TEAM_ADMIN_ROLE _GOOGLE_VOICE_ADMIN_ROLE _GROUPS_ADMIN_ROLE _GROUPS_EDITOR_ROLE Display Name for Groups Editor Role in Admin Console. _GROUPS_READER_ROLE Display Name for Groups Reader Role in Admin Console. _HELP_DESK_ADMIN_ROLE _INVENTORY_REPORTING_ADMIN_ROLE _LDAP_GROUP_MANAGEMENT_READONLY_ROLE _LDAP_PASSWORD_REBIND_ROLE _LDAP_USER_MANAGEMENT_READONLY_ROLE _LEGACY_ENTERPRISE_SUPPORT_ROLE Legacy Enterprise Support Role value. _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE Legacy Resold Enterprise Support Role value. _MOBILE_ADMIN_ROLE _PLAY_FOR_WORK_ADMIN_ROLE _RESELLER_ADMIN_ROLE _SEED_ADMIN_ROLE _SERVICE_ADMIN_ROLE _STORAGE_ADMIN_ROLE _TEAM_ADMIN_ROLE _USER_MANAGEMENT_ADMIN_ROLE
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=REMOVE_PRIVILEGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Privilege {PRIVILEGE_NAME} removed from role {ROLE_NAME}

Role Rename

Event details
Event name	RENAME_ROLE
Parameters	NEW_VALUE string The new role name. ROLE_NAME string The old role name that is being renamed. For more information about delegated administrator privileges, see the administration help center. Possible values: _AFFILIATE_ADMIN_ROLE Affiliate admin role value. _DAR_NETWORK_MANAGEMENT_ROLE Indirect Reseller Network Admin role value. _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE Indirect Reseller Resold Customer Admin role value. _DEGRADED_AFFILIATE_ADMIN_ROLE Degraded Affiliate admin role value. _DIRECTORY_SYNC_ADMIN_ROLE _DOMAINLESS_SUPER_ADMIN_ROLE _DRIVE_TEAM_ADMIN_ROLE _GOOGLE_VOICE_ADMIN_ROLE _GROUPS_ADMIN_ROLE _GROUPS_EDITOR_ROLE Display Name for Groups Editor Role in Admin Console. _GROUPS_READER_ROLE Display Name for Groups Reader Role in Admin Console. _HELP_DESK_ADMIN_ROLE _INVENTORY_REPORTING_ADMIN_ROLE _LDAP_GROUP_MANAGEMENT_READONLY_ROLE _LDAP_PASSWORD_REBIND_ROLE _LDAP_USER_MANAGEMENT_READONLY_ROLE _LEGACY_ENTERPRISE_SUPPORT_ROLE Legacy Enterprise Support Role value. _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE Legacy Resold Enterprise Support Role value. _MOBILE_ADMIN_ROLE _PLAY_FOR_WORK_ADMIN_ROLE _RESELLER_ADMIN_ROLE _SEED_ADMIN_ROLE _SERVICE_ADMIN_ROLE _STORAGE_ADMIN_ROLE _TEAM_ADMIN_ROLE _USER_MANAGEMENT_ADMIN_ROLE
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=RENAME_ROLE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Role renamed from {ROLE_NAME} to {NEW_VALUE}

Role Updated

Event details
Event name	UPDATE_ROLE
Parameters	ROLE_ID string Unique identifier for this privilege. A delegated administrator's role is granted by the super administrator. See note for restrictions. ROLE_NAME string The name of the new role to apply. For more information about delegated administrator roles, see the administration help center. Possible values: _AFFILIATE_ADMIN_ROLE Affiliate admin role value. _DAR_NETWORK_MANAGEMENT_ROLE Indirect Reseller Network Admin role value. _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE Indirect Reseller Resold Customer Admin role value. _DEGRADED_AFFILIATE_ADMIN_ROLE Degraded Affiliate admin role value. _DIRECTORY_SYNC_ADMIN_ROLE _DOMAINLESS_SUPER_ADMIN_ROLE _DRIVE_TEAM_ADMIN_ROLE _GOOGLE_VOICE_ADMIN_ROLE _GROUPS_ADMIN_ROLE _GROUPS_EDITOR_ROLE Display Name for Groups Editor Role in Admin Console. _GROUPS_READER_ROLE Display Name for Groups Reader Role in Admin Console. _HELP_DESK_ADMIN_ROLE _INVENTORY_REPORTING_ADMIN_ROLE _LDAP_GROUP_MANAGEMENT_READONLY_ROLE _LDAP_PASSWORD_REBIND_ROLE _LDAP_USER_MANAGEMENT_READONLY_ROLE _LEGACY_ENTERPRISE_SUPPORT_ROLE Legacy Enterprise Support Role value. _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE Legacy Resold Enterprise Support Role value. _MOBILE_ADMIN_ROLE _PLAY_FOR_WORK_ADMIN_ROLE _RESELLER_ADMIN_ROLE _SEED_ADMIN_ROLE _SERVICE_ADMIN_ROLE _STORAGE_ADMIN_ROLE _TEAM_ADMIN_ROLE _USER_MANAGEMENT_ADMIN_ROLE
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UPDATE_ROLE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Role {ROLE_NAME} updated

Unassign Role

Event details
Event name	UNASSIGN_ROLE
Parameters	ORG_UNIT_NAME string The organizational unit (OU) name (path). ROLE_NAME string Role name that is being unassigned from USER_EMAIL. A delegated administrator's role is granted by the super administrator. See note for restrictions. Possible values: _AFFILIATE_ADMIN_ROLE Affiliate admin role value. _DAR_NETWORK_MANAGEMENT_ROLE Indirect Reseller Network Admin role value. _DAR_RESOLD_CUSTOMER_MANAGEMENT_ROLE Indirect Reseller Resold Customer Admin role value. _DEGRADED_AFFILIATE_ADMIN_ROLE Degraded Affiliate admin role value. _DIRECTORY_SYNC_ADMIN_ROLE _DOMAINLESS_SUPER_ADMIN_ROLE _DRIVE_TEAM_ADMIN_ROLE _GOOGLE_VOICE_ADMIN_ROLE _GROUPS_ADMIN_ROLE _GROUPS_EDITOR_ROLE Display Name for Groups Editor Role in Admin Console. _GROUPS_READER_ROLE Display Name for Groups Reader Role in Admin Console. _HELP_DESK_ADMIN_ROLE _INVENTORY_REPORTING_ADMIN_ROLE _LDAP_GROUP_MANAGEMENT_READONLY_ROLE _LDAP_PASSWORD_REBIND_ROLE _LDAP_USER_MANAGEMENT_READONLY_ROLE _LEGACY_ENTERPRISE_SUPPORT_ROLE Legacy Enterprise Support Role value. _LEGACY_RESOLD_ENTERPRISE_SUPPORT_ROLE Legacy Resold Enterprise Support Role value. _MOBILE_ADMIN_ROLE _PLAY_FOR_WORK_ADMIN_ROLE _RESELLER_ADMIN_ROLE _SEED_ADMIN_ROLE _SERVICE_ADMIN_ROLE _STORAGE_ADMIN_ROLE _TEAM_ADMIN_ROLE _USER_MANAGEMENT_ADMIN_ROLE USER_EMAIL string The delegated administrator's primary email address. The role is being unassigned from this user. For more information about delegated administrator roles, see the administration help center.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin?eventName=UNASSIGN_ROLE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Unassigned role {ROLE_NAME} from user {USER_EMAIL}

Note: The ROLE_ID and ROLE_NAME parameters are for future API use only. When making an API request, don't use the delegated admin ROLE_ID or ROLE_NAME parameters for persistent data as these could break when the ROLE_ID and ROLE_NAME parameters change in the future.