How to restrict access of a service account to only specified user(s) in google workspace?

Question

I'm developing an application that needs to read and label emails from a single, specific mailbox that is a part of a google workspace.

I managed to connect a service account to the workspace using domain-wide delegation but the issue is that it has full access to every mailbox in the workspace, which is an issue because I NEED follow the least privilege principle.

My goal is to restrict this Service Account so it can only impersonate one specific user (e.g., [email protected]).

I lurked around in the google workspace admin console and I didn't find anything... Maybe there is a way to restrict the scope of users for the service account representing my app?

Thanks!

credentials = service_account.Credentials.from_service_account_info(
   creds_dict,
   scopes=scopes,
   subject='[email protected]' // <- i could change it to any user in the org and it would still be working which is not acceptable. (for the domain-wide delegation)
)
gmail_service = build("gmail", "v1", credentials=credentials, cache_discovery=False)

I tried creating a Security Group, and somehow restrict the app in the App Access Control settings in the Admin Console, but i haven't found any possibility to do so.

Well...if you only need access to a specific account...then generate OAuth credentials only for that account. Using Domain-wide delegation is overkill. — TheAddonDepot
– TheAddonDepot, Commented Sep 14 at 16:31

Linda Lawton - DaImTo · Accepted Answer · 2025-06-16 16:27:00Z

2

Service accounts have full access to the for the user they are deliciated as. The system sees it as that user has logged in so its full access.

There is no way to limit a service account to be able to delegate to a single user it can delegate to any user on the domain.

If you want to limit it i would suggest you use oauth2

answered Jun 16 at 16:27

Linda Lawton - DaImTo

118k40 gold badges229 silver badges511 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to restrict access of a service account to only specified user(s) in google workspace?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related