# Configuring Built-In Role Permissions

## Service Account Scopes and Built-In Roles for an Impersonated User

The following table lists the minimum Service Account Scopes and Built-In Roles applied to an Impersonated User for the respective connector operations:

<table class="span-table table-wrap"> <tr> <td>Connector Operation</td> <td>Service Account Scopes</td> <td>Impersonate User</td> </tr> <tr> <td>Test Connection</td> <td><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code></td> <td>No Role</td> </tr> <tr> <td>Role related operations(Aggregate Role, Add and Remove Role)</td> <td><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><code>https://www.googleapis.com/auth/admin.directory.rolemanagement</code><br><code>https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly</code></td> <td>Super Admin</td> </tr> <tr> <td>Create Account with Role</td> <td><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><code>https://www.googleapis.com/auth/admin.directory.rolemanagement</code><br><code>https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly</code></td> <td>Super Admin</td> </tr> <tr> <td>Refresh Account</td> <td rowspan="6"><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td rowspan="6"><strong>G-Suite</strong><br>User Management Admin, Groups Admin, and Super Admin (only required if Role entitlements are managed)<br><br><strong>GCP</strong><br>Cloud Asset Viewer, Service account user, Project IAM Admin, Folder IAM Admin, Organization Administrator (only required if organization level access managed), Service Account Admin, User Management, and Group Admin</td> </tr> <tr> <td>Account Aggregation</td> </tr> <tr> <td>Create Account with Entitlement(s)</td> </tr> <tr> <td>Update Account attribute(s) (For accounts with entitlement)</td> </tr> <tr> <td>Add and Remove Entitlement(s)</td> </tr> <tr> <td>Partitioning Aggregation</td> </tr> <tr> <td>Group Aggregation</td> <td><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/apps.groups.settings</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td rowspan="2"><strong>G-Suite</strong><br>Group Admin<br><br><strong>GCP</strong><br>Cloud Asset Viewer, Organization Administrator (only required if organization level access is managed), Service Account Admin, Folder IAM Admin, and Project IAM Admin</td> </tr> <tr> <td>Create and Update Group</td> <td><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/apps.groups.settings</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/cloud-platform</code><br><code>https://www.googleapis.com/auth/iam</code></td> </tr> <tr> <td>Create Account without Entitlement(s)</td> <td rowspan="4"><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td rowspan="4"><strong>G-Suite</strong><br>User Management Admin, Super Admin (only required if managing domain as a user)<br><br><strong>GCP</strong><br>Service Account Admin</td> </tr> <tr> <td>Enable, Disable, and Delete Account</td> </tr> <tr> <td>Update Account attribute(s) (For accounts without entitlement)</td> </tr> <tr> <td>Change Password</td> </tr> <tr> <td>Delta Aggregation for Account</td> <td><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><code>https://www.googleapis.com/auth/admin.reports.audit.readonly</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>G-Suite</strong><br>User Management Admin, Groups Admin, Custom Role (Reports), Super Admin (only required if managing domain as a user)<br><br><strong>GCP</strong><br>Cloud Asset Viewer</td> </tr> <tr> <td>Delta Aggregation for Group</td> <td><strong>G-Suite</strong><br><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.reports.audit.readonly</code><br><br><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>G-Suite</strong><br>Groups Admin and Custom Role (Reports)<br><br><strong>GCP</strong><br>Cloud Asset Viewer</td> </tr> <tr> <td>Delete Data Transfer</td> <td><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code></td> <td>User Management, Group Admin, and Data Transfer</td> </tr> <tr> <td>DelegatedAdmins</td> <td><code>https://www.googleapis.com/auth/admin.directory.group</code><br><code>https://www.googleapis.com/auth/admin.directory.user</code><br><code>https://www.googleapis.com/auth/gmail.settings.sharing</code><br><code>https://www.googleapis.com/auth/gmail.settings.basic</code><br><code>https://mail.google.com/</code><br><code>https://www.googleapis.com/auth/gmail.modify</code><br><code>https://www.googleapis.com/auth/gmail.readonly</code></td> <td>User Management, Group Admin, and Gmail (Settings)</td> </tr> <tr> <td>Aggregation for Folder and Project</td> <td><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>GCP</strong><br>Cloud Asset Viewer</td> </tr> <tr> <td>Aggregation for IAM Role</td> <td><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>GCP</strong><br>Cloud Asset Viewer and Organization Role Viewer</td> </tr> <tr> <td>Create, Update, and Delete IAM Roles</td> <td><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>GCP</strong><br>Organization Role Administrator</td> </tr> <tr> <td>IAM Resource Permission</td> <td><strong>GCP</strong><br><code>https://www.googleapis.com/auth/iam</code><br><code>https://www.googleapis.com/auth/cloud-platform</code></td> <td><strong>GCP</strong><br>Cloud Asset Viewer, Organization Role Viewer, Organization Administrator (only required if managing Organization level access), Service Account Admin, Folder IAM Admin, and Project IAM Admin</td> </tr> <tr> <td>To manage all operations on domain as Account type in GCP</td> <td><code>https://www.googleapis.com/auth/admin.directory.domain</code></td> <td>Super Admin</td> </tr> </table>