Google Workspace 사용자는 스크립트를 실행하거나 부가기능 또는 웹 앱과 같은 앱을 사용할 때 범위라고 하는 데이터 수준에 대한 액세스 권한을 부여합니다. 이 페이지에서는 사용자가 Google Workspace 계정 내에서 액세스 권한을 부여한 범위를 모니터링하거나 취소하는 방법을 설명합니다.
중요: 범위에 대한 액세스 권한을 취소한 후 사용자가 액세스 권한을 다시 부여할 수 있습니다. 필요에 따라 액세스 권한을 취소할 수 있도록 사용자가 액세스 권한을 부여하지 않기를 원하는 범위에 대한 알림을 설정하는 것이 좋습니다. OAuth 부여에 대한 알림 만들기를 참고하세요.
범위에 대한 액세스 권한을 취소하려면 범위별 OAuth 부여 이벤트 모니터링 단계를 따른 다음 취소할 이벤트를 선택하고 사용자의 액세스 토큰 취소를 클릭합니다.
대부분의 Google Workspace 서비스에 대한 액세스를 제한할 수 있습니다. Gmail 및 Google Drive의 경우 사용자가 고위험으로 분류되지 않은 OAuth 범위에 액세스할 수 있도록 허용하면서 고위험 OAuth 범위에 대한 액세스를 제한할 수 있습니다. 앱이 제한된 고위험 OAuth 범위에 대한 액세스를 요청하는 경우 앱을 신뢰할 수 없다면 사용자는 해당 앱을 승인할 수 없습니다.
[null,null,["최종 업데이트: 2025-08-31(UTC)"],[[["\u003cp\u003eThis guide explains how Google Workspace admins with specific account types (Enterprise, Education Standard, or Education Plus) can monitor and control the data access users grant to Apps Script.\u003c/p\u003e\n"],["\u003cp\u003eAdmins can monitor OAuth grant events by searching for specific scopes within the Google Admin console's Investigation tool and subsequently revoke those grants if necessary.\u003c/p\u003e\n"],["\u003cp\u003eYou can set up alerts to be notified when users grant access to certain OAuth scopes, allowing for proactive management of data permissions.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Workspace allows for restricting access to high-risk OAuth scopes for enhanced security, especially for Gmail and Google Drive, while still enabling access to lower-risk scopes.\u003c/p\u003e\n"],["\u003cp\u003eAdmins have the ability to create activity rules and manage them to define the conditions under which alerts are triggered and to whom they are sent.\u003c/p\u003e\n"]]],[],null,["# Monitor & restrict data access\n\n| **Note:** You must have an Enterprise, Education Standard, or Education Plus Google Workspace account to monitor and restrict the data access that users grant to Apps Script.\n\nGoogle Workspace users grant access to levels of data, known as scopes, when\nthey run scripts or use apps like add-ons or web apps. This page explains how\nyou can monitor or revoke the scopes that users grant access to within their\nGoogle Workspace account.\n\nMonitor OAuth grant events by scope\n-----------------------------------\n\nTo view events where users grant access to a specific scope or scopes, take the\nfollowing steps:\n\n1. In the Google Admin console, go to Menu\n menu\n \\\u003e **Security**\n \\\u003e **Security center**\n \\\u003e **Investigation tool**.\n\n [Go to Investigation tool](https://admin.google.com/ac/sc/investigation)\n2. Click **Data Source** and select **OAuth log events**.\n\n3. Click **Add condition** \\\u003e **Attribute**\n and select **Event**.\n\n4. Click **Event** and select **Grant**.\n\n5. Click **Add condition** \\\u003e **Attribute**\n and select **Scope**.\n\n6. For **Scope** , enter the scope you want to monitor. For a list of scopes,\n refer to [OAuth 2.0 Scopes for Google APIs](https://developers.google.com/identity/protocols/oauth2/scopes).\n\n7. Click **Search**. A list of grant events displays for the scopes you\n specified.\n\nRevoke OAuth grants\n-------------------\n\n**Important** : After you revoke access to a scope, users can re-grant access. We\nrecommend that you set up alerts for scopes that you don't want users to grant\naccess to so that you can revoke access as needed. Refer to [Create an alert\nfor OAuth grants](#create_an_alert_for_oauth_grants).\n\nTo revoke access to a scope, follow the steps for [Monitor OAuth grant events by\nscope](#monitor_oauth_grant_events_by_scope), then select the events you want to revoke and click **Revoke access\ntokens for users**.\n\nCreate an alert for OAuth grants\n--------------------------------\n\nTo receive an alert when someone grants access to a specific scope, follow the\nsteps for [Monitor OAuth grant events by scope](#monitor_oauth_grant_events_by_scope),\nthen take the following steps:\n\n1. At the top of the search, click **Create activity rule**.\n2. For **Rule name**, enter a name for the alert.\n3. Click **Next: View Conditions** . The conditions automatically populate from the search parameters. You can edit them if needed, then click **Next: Add Actions**.\n4. In **Threshold 1** , select a time frame and threshold for the rule and check the **Send to alert center** box.\n5. Click **Add email recipients** and enter the email addresses that should receive alerts. Click **Done**.\n6. Click **Next: Review**.\n7. Review the details and click **Create Rule**\n\nFor more information, refer to [Create and manage activity rules](https://support.google.com/a/answer/9275024).\n\nRestrict access to high-risk OAuth scopes\n-----------------------------------------\n\nYou can restrict access to most Google Workspace services. For Gmail\nand Google Drive, you can restrict access to high-risk OAuth\nscopes while allowing users to give access to OAuth scopes that aren't\nclassified as high-risk. If an app requests access to a restricted high-risk\nOAuth scope, and you haven't specifically trusted the app, users can't authorize\nit.\n\nTo restrict access to high-risk OAuth scopes, refer to [Restrict or unrestrict\nGoogle services](https://support.google.com/a/answer/7281227#restrictaccess&zippy=%2Cmanage-access-to-google-services-restricted-or-unrestricted%2Cmanage-access-to-apps-trusted-limited-or-blocked%2Cstep-restrict-or-unrestrict-google-services)."]]
