An OAuth scope is dangerous when it grants broad, standing access to your data. The ones to watch let an app read all mail, manage every file in Drive or SharePoint, act as any user, or read your whole directory. “Read your calendar” is a low-risk scope. “Read, send, and permanently delete all your mail” sits at the other end. This guide covers how to tell them apart across Google Workspace and Microsoft 365.

Scopes come in tiers of risk

Low. Read-only access to a narrow resource, like a user’s profile or a single calendar’s free/busy.
Medium. Read access to substantial data: all calendar events, contacts, or file metadata.
High. Full read/write to mail or files (mail.google.com, full Drive, Mail.ReadWrite), directory access, or the ability to act on behalf of users.

A useful rule of thumb: if a scope lets an app send mail, delete data, or act as a user, it belongs in the “prove this is necessary” pile.

The scope names to look for

Consent screens and admin consoles show the raw scope strings. In Google Workspace, search your connected-apps list for these:

https://mail.google.com/: full Gmail access, including send and permanent delete.
gmail.readonly: read every message in the mailbox.
drive: see, edit, create, and delete all Drive files. The read-only variant drive.readonly still exposes the contents of every file.
admin.directory.user: manage the user accounts in your domain directory.

In Microsoft 365, the Microsoft Graph equivalents:

Mail.ReadWrite and Mail.Send: read, write, and send mail. Granted as application permissions, they cover every mailbox in the tenant.
Files.ReadWrite.All: edit every file the grant can reach; org-wide when admin-consented as an application permission.
Directory.Read.All: read the full directory of users, groups, and app registrations.
MailboxSettings.ReadWrite: change mailbox rules. Attackers use it to set up silent mail forwarding.

Delegated vs application permissions

Context changes how risky the same scope is. A permission delegated to a single user is bounded by that user. The same permission granted as an application permission (Microsoft) or via domain-wide delegation (Google) is org-wide and unattended. It runs with no human in the loop and reaches every mailbox or file. Those deserve the most scrutiny.

How to spot excessive OAuth permissions

Apps with full-mailbox or full-Drive scopes that only need to read one thing.
Org-wide consent granted in a single click, often long ago.
Scopes held by apps from unverified publishers.
High-scope tokens attached to accounts that lost MFA, or lost their owner entirely.

Turning scopes into a decision

Reading raw scope strings across hundreds of grants is tedious and error-prone. Esmeris translates them into plain-English risk and ranks every grant, so you can see at a glance which apps are over-permissioned. The audit is read-only, and the sample report shows the output.

Start your free audit