Using GAM without superadmin

[Razak Yasin]

Hi guys, 

I have a question in mind & would need help for advise,

1. How to add specific permissions to people to perform various api tasks using GAM? e.g. if i want to grant you permissions to use API to manage user, or groups or google devices etc, what needs to be done? 2. How can I issue API access but with no superadmin rights ?

[Brian Kim]

super admin is only required for setting up domain wide delegation. you can use GAM with limited privileges by 

1. Authorizing GAM with reduced privileges

2. Selecting limited APIs when doing gam oauth create

3. When you set up domain wide delegation (you can do that for other admins), you can choose limited scopes instead of authorizing everything.

[Jay Lee]

You want to use delegated admins:

https://support.google.com/a/answer/33325?hl=en

In general if a delegated admin has the rights to do something in the admin console, they can do it with GAM.

I'd recommend just not setting up service account domain wide delegation for these users. They should not have access to user data 

Jay

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/efafb427-8025-4000-b75c-76eeda9e5912n%40googlegroups.com.

[Ross Scroggs]

Razak,

For Advanced GAM, see: https://github.com/taers232c/GAMADV-XTD3/wiki/Authorization#configure-limited-access

Ross

--

ross.s...@gmail.com

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/3ca4f041-3306-491c-b37a-a02b9fba5308n%40googlegroups.com.