# Choose scope-specific Google Workspace app access before marking an integration Trusted

> An application that needs one service does not automatically need permission to request every Workspace scope.

- Canonical URL: https://update.dsesecurity.com/updates/google-workspace-oauth-specific-data-versus-trusted/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:54+00:00
- Modified: 2026-10-15T13:36:18+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Microsoft 365 & Identity
- Reading time: 2 minutes

## What you need to know

An application that needs one service does not automatically need permission to request every Workspace scope.

## Potentially affected

This applies to Google Workspace OAuth app-access controls. The selected organizational unit, app type, Google sign-in requirements, and any Context-Aware Access exemption must be checked separately.

## DSE recommendation

DSE recommends identifying the exact OAuth client before approving an integration.

## Article

An application that needs one service does not automatically need permission to request every Workspace scope.

## Source facts

Google Workspace API controls distinguish Trusted, Specific Google data, Limited, and Blocked application access. Trusted allows access across Workspace services, including restricted ones. Specific Google data limits an app to the scopes configured by the administrator, while Limited allows only unrestricted services. The Admin console exposes the OAuth client ID and requested scopes for review. Google warns that the scope list shown during configuration can include everything an app has ever requested; the app’s details view shows the exact scopes currently configured.

Source: [Google — App access controls](https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data?hl=en).

## Applicability

This applies to Google Workspace OAuth app-access controls. The selected organizational unit, app type, Google sign-in requirements, and any Context-Aware Access exemption must be checked separately.

## DSE recommendation

DSE recommends identifying the exact OAuth client before approving an integration. Obtain the vendor’s required scope list and map each permission to the business task it enables. Prefer a scope-specific decision where it satisfies the approved requirement, and preserve necessary sign-in scopes. Review inherited organizational-unit settings and any explicit exceptions before expanding access. Record the approver, client ID, intended user population, and review date. Recheck scopes after integration changes instead of assuming the original app name represents an unchanged permission request.

## Verification

Use a test user in the intended organizational unit to complete the approved integration workflow. Confirm the configured client and scopes in the details view, then test that an unapproved data operation remains unavailable. Record results without exporting user tokens or live data from unrelated services.

## Official reference

[Google — App access controls](https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data?hl=en). Reviewed October 15, 2026.

## Primary reference

- Name: Google — App access controls
- Authority: knowledge.workspace.google.com
- URL: https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data?hl=en
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose scope-specific Google Workspace app access before marking an integration Trusted,” DSE Security, https://update.dsesecurity.com/updates/google-workspace-oauth-specific-data-versus-trusted/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.