Resources/Glossary
OAuth scopes in plain English
Every common Google Workspace and Microsoft 365 permission a third-party app can ask for, translated into what it actually lets the app do.
4 min readUpdated September 9, 2026
01How to read a scope
A scope is the unit of permission in OAuth. When an app asks for access, it asks for a list of scopes, and the person clicking Allow grants all of them at once. The names are written for developers, not for the people approving them — which is how “Files.Read.All” gets approved by someone who thinks they are connecting a calendar.
Three patterns tell you most of what you need to know before you look anything up.
- Read versus ReadWrite (Microsoft) or readonly versus the bare scope (Google). Read-only access can copy everything; write access can also change, send, or delete it.
- The .All suffix on Microsoft, or a scope naming the admin or the whole Drive on Google, means the permission spans the organization or the entire account — not one folder, not one mailbox.
- offline_access, on either provider, means the app keeps its access after the person signs out. Almost every app requests it. It is the reason a forgotten grant is a permanent one.
02Google Workspace
Google scopes are URLs beginning with https://www.googleapis.com/auth/. The table shows the distinguishing tail of each.
| Scope | Lets the app… |
|---|---|
| mail.google.com | read, send, and delete all email in that mailbox |
| gmail.modify | read and change email in that mailbox |
| gmail.send | send email as that person |
| gmail.readonly | read all email in that mailbox |
| gmail.metadata | see who that person emails and when |
| auth/drive | read and edit every file in that person’s Google Drive |
| drive.readonly | read every file in that person’s Google Drive |
| drive.file | read and edit only the specific files it is used with |
| drive.appdata | store its own data in that person’s Drive |
| spreadsheets | read and edit that person’s spreadsheets |
| documents | read and edit that person’s documents |
| presentations | read and edit that person’s presentations |
| auth/calendar | see and change that person’s calendar |
| calendar.events | see and change that person’s calendar events |
| calendar.readonly | see that person’s calendar and meeting details |
| contacts | see and change that person’s contacts |
| contacts.readonly | see that person’s contacts |
| auth/admin.* | make administrator-level changes to your Google Workspace |
| cloud-platform | access your Google Cloud resources |
| userinfo.email | know that person’s email address |
| userinfo.profile | know that person’s name and profile photo |
03Microsoft 365 and Entra ID
Microsoft Graph scopes are dotted names. The ones ending in .All are the admin-consent tier: they reach across every user, file, or object in the tenant, and they are the scopes to read most carefully.
| Scope | Lets the app… |
|---|---|
| Mail.ReadWrite | read, change, and delete email in that mailbox |
| Mail.Send | send email as that person |
| Mail.Read | read all email in that mailbox |
| Files.ReadWrite.All | read and change every file across your organization’s OneDrive and SharePoint |
| Files.Read.All | read every file across your organization’s OneDrive and SharePoint |
| Files.ReadWrite | read and change that person’s files |
| Files.Read | read that person’s files |
| Sites.ReadWrite.All | read and change everything in your SharePoint sites |
| Sites.Read.All | read everything in your SharePoint sites |
| Calendars.ReadWrite | see and change that person’s calendar |
| Calendars.Read | see that person’s calendar and meeting details |
| OnlineMeetings.ReadWrite | create and change that person’s online meetings |
| OnlineMeetings.Read | see that person’s online meetings |
| ChannelMessage.Read.All | read messages in your Teams channels |
| Chat.ReadWrite | read and send that person’s Teams chats |
| Chat.Read | read that person’s Teams chats |
| Contacts.ReadWrite | see and change that person’s contacts |
| Contacts.Read | see that person’s contacts |
| Directory.ReadWrite.All | read and change your organization’s entire directory |
| Directory.Read.All | read your organization’s entire directory |
| User.ReadWrite.All | read and change every user account in your organization |
| User.Read.All | read every user account in your organization |
| User.ReadBasic.All | see basic details of every user in your organization |
| User.Read | see that person’s basic account profile |
| Group.ReadWrite.All | read and change your organization’s groups |
| Group.Read.All | read your organization’s groups and who belongs to them |
| Application.ReadWrite.All | read and change every app registered in your organization |
| Application.Read.All | read every app registered in your organization |
| AuditLog.Read.All | read your organization’s sign-in and audit logs |
04Scopes both providers share
These come from OpenID Connect and appear on almost every sign-in-with grant. Three of them are harmless identity scopes. The fourth is not.
| Scope | Lets the app… |
|---|---|
| openid | confirm who that person is when signing in |
| profile | know that person’s name and profile photo |
| know that person’s email address | |
| offline_access | keep working in the background without that person signing in again |
05Combinations worth flagging
Individual scopes are only half the reading. The dangerous findings are combinations — an AI product on the one side, and one of these on the other.
- Mailbox read plus offline_access: the app can read every message, forever, without anyone noticing a login.
- Organization-wide file read (Files.Read.All, Sites.Read.All) on a grant approved by a single user: the widest possible reach, approved by the narrowest possible review.
- Directory.Read.All alongside any data scope: the app knows who everyone is and what it can read from them.
- Mail.Send or gmail.send held by a tool that has no reason to send: an app that can send as your people is an app that can phish as your people.
Why we wrote this down
A finding is only useful to the person who has to decide about it. A ForgeWatch report never asks an owner or an employee to decode a scope identifier — every permission is explained in language like the rows above, and the raw identifier appears only where an administrator needs it to find the app.
See which of these your workforce has already granted
One read-only authorization returns every app holding a token in your domain, with each scope translated and each finding explained.
Get your inventoryKeep reading
The shadow-AI field guide
How third-party AI tools get OAuth access to your cloud, why nothing you run can see it, and what a grant actually lets them read.
9 min read →
From app inventory to audit evidence
How an inventory becomes evidence under HIPAA, SOC 2, PCI DSS, ISO 27001 and the AI frameworks — and why the word is “may support,” not “satisfies.”
8 min read →