Domain-Wide Delegation: the critical and least-audited risk in Google Workspace

By the QuantumSec team

Domain-wide delegation (DWD) is one of the most powerful —and most dangerous— features of Google Workspace. It allows a service account to act on behalf of any user in the domain. Used well, it enables legitimate integrations; poorly controlled, it's a direct path to full takeover of the environment. The DeleFriend research highlighted how easy it is to abuse.

What domain-wide delegation (DWD) is

Domain-wide delegation allows a Google Cloud (GCP) service account to access the data of a Workspace's users on their behalf, with a set of permissions (scopes) authorized in the admin console. It's used for integrations that need to operate over many mailboxes or files, such as backup, migration or compliance tools.

Why it's so dangerous

A service account with domain-wide delegation can impersonate any user in the domain —including super admins— without their password and without triggering MFA. That means potential access to all the Gmail, Drive and Calendar of the organization. It's possibly the most sensitive asset in the environment and the one most frequently left out of security reviews.

DeleFriend: the design flaw

Security researchers (Hunters) described in DeleFriend how an attacker with limited access to a GCP project can identify and abuse service accounts with domain-wide delegation. The key is that the delegation is tied to the service account identifier and not to a specific key, and that it's possible to try combinations of tokens and scopes (JWT fuzzing) without restrictions to find exploitable delegations.

From GCP to Workspace (and back)

Domain-wide delegation blurs the boundary between Google Cloud and Google Workspace. Whoever controls a service account with DWD in GCP can pivot toward the Workspace and impersonate users; and conversely, compromising the Workspace can facilitate access to GCP. Auditing one without the other leaves a critical gap: you must look at both sides of the integration.

How to audit and mitigate the risk

The key actions: inventory all service accounts with domain-wide delegation and the scopes granted to them; apply the minimum scopes essential for each integration; restrict in GCP who can create keys for those service accounts (IAM); rotate keys periodically; and remove delegations that are no longer used. A Workspace audit must review this explicitly, because it's rarely looked at.

FAQ

Is DeleFriend still exploitable?

Abuse of domain-wide delegation depends on the design of the feature and the configuration of each organization, not on a one-off patch. Mitigation is on your side: inventory of service accounts with DWD, least privilege of scopes, control of who generates keys in GCP and monitoring.

How do I know if I have domain-wide delegation active?

It's reviewed in the Google admin console (domain-wide delegation management) cross-referenced with the GCP service accounts and their IAM permissions. It's precisely one of the points we cover in a Google Workspace audit.