Google Workspace Domain Wide Delegation [splunk-google]

This use case detects when a domain-wide delegation of authority is granted to a service account. Domain-wide delegation can be configured to grant third-party and internal applications to access the data of Google Workspace users. An adversary may configure domain-wide delegation to maintain access to their target’s data. This activity on its own does not indicate malicious activity, but should be validated due to its wide-reaching access.