Working with activity scopes

Each Google Workspace and Microsoft 365 activity requires certain permissions or scopes to run successfully. These permissions may or may not be configured for the user or service account running an automation, which can cause processes to fail.

Starting with versions 2.7.21 of the Google Workspace and Microsoft 365 activity packages, each activity include a warning informing you of the scope(s) it requires to run properly. The scopes are documented on each activity help page (accessible via the Help or F1 button), from the most restrictive permissions to the least restrictive ones.

Note: If a scope is missing from the required minimal scopes, this does not mean an activity will not work at all. Some activity functionalities may not work. For example, if you want to use Get File or Folder List, but don't configure the Drive.Labels.ReadOnly scope, the activity can retrieve the file, but will not be able to retrieve the Drive labels associated with the respective file.

For example, let's take the Google Workspace Get File List. This activity requires one of the following combination of scopes:

https://www.googleapis.com/auth/drive.readonly AND https://www.googleapis.com/auth/drive.labels.readonly
OR
https://www.googleapis.com/auth/drive AND https://www.googleapis.com/auth/drive.labels
OR
https://www.googleapis.com/auth/drive.appdata AND https://www.googleapis.com/auth/drive.labels.readonly
OR
https://www.googleapis.com/auth/drive.metadata AND https://www.googleapis.com/auth/drive.labels.readonly
OR
https://www.googleapis.com/auth/drive.metadata.readonly AND https://www.googleapis.com/auth/drive.labels.readonly
OR
https://www.googleapis.com/auth/drive.photos.readonly AND https://www.googleapis.com/auth/drive.labels.readonly
OR
https://www.googleapis.com/auth/drive AND https://www.googleapis.com/auth/drive.labels.readonly

where:

• https://www.googleapis.com/auth/drive.readonly AND https://www.googleapis.com/auth/drive.labels.readonly is the most restrictive set of permissions minimally required to retrieve files. It gives you readonly access, which means you can see and download Google Drive files, but cannot perform any other actions on said files.
• https://www.googleapis.com/auth/drive AND https://www.googleapis.com/auth/drive.labels.readonly is the least restrictive set of permissions you can configure. The https://www.googleapis.com/auth/drive scope allows you to see, edit, create, and delete all of your Google Drive files.

Let's use another example from Microsoft 365 with Get Email By ID. This activity requires one of the following combination of scopes:

Mail.Read
OR
Mail.ReadWrite
OR
Mail.Read.Shared
OR
Mail.ReadWrite.Shared

where:

• Mail.Read is the most restrictive permission minimally required to retrieve emails. It gives you Mail.Read access, which means you can read emails in your own inbox.
• Mail.ReadWrite.Shared is the least restrictive permission you can configure. The Mail.ReadWrite.Shared scope allows you to create, read, update, and delete any mail you have permission to access, including your own and the ones in a shared or delegated inbox.