未使用全域委派时，服务账号调用Admin SDK API遇权限错误问题

我尝试使用服务账号通过Admin SDK获取Google Workspace活动记录，已为该服务账号分配具备Reports权限的管理员角色，但仍收到如下错误：

Access denied. You are not authorized to read activity records. [401]
Errors [
Message[Access denied. You are not authorized to read activity records.] Location[Authorization - header] Reason[authError] Domain[global]
]

报错代码片段 #

using Google.Apis.Admin.Reports.reports_v1;
using Google.Apis.Auth.OAuth2;
using Google.Apis.Services;

var scopes = new[]
{
    ReportsService.ScopeConstants.AdminReportsAuditReadonly,
};
var serviceAccountMail = "<ServiceAccountMail>";
var serviceAccountPrivateKey = "<PrivateKey>";
var serviceAccountCredential = new ServiceAccountCredential(new ServiceAccountCredential.Initializer(serviceAccountMail).FromPrivateKey(serviceAccountPrivateKey)) { Scopes = scopes };
var reportsService = new ReportsService(new BaseClientService.Initializer { HttpClientInitializer = serviceAccountCredential });
var listActivitiesRequest = reportsService.Activities.List("all", ActivitiesResource.ListRequest.ApplicationNameEnum.Token);
var activities = await listActivitiesRequest.ExecuteAsync();

foreach (var activity in activities.Items)
{
    Console.WriteLine(activity);
}

对比正常运行的代码 #

相同配置下，调用Directory Service的代码可正常执行：

using Google.Apis.Admin.Directory.directory_v1;
using Google.Apis.Auth.OAuth2;
using Google.Apis.Services;

var scopes = new[]
{
    DirectoryService.ScopeConstants.AdminDirectoryUserReadonly
};

var serviceAccountMail = "<ServiceAccountMail>";
var serviceAccountPrivateKey = "<PrivateKey>";
var serviceAccountCredential =
    new ServiceAccountCredential(
            new ServiceAccountCredential.Initializer(serviceAccountMail).FromPrivateKey(serviceAccountPrivateKey))
        { Scopes = scopes };

var directoryService = new DirectoryService(new BaseClientService.Initializer { HttpClientInitializer = serviceAccountCredential });
var listUsersRequest = directoryService.Users.List();
listUsersRequest.Customer = "<CustomerId>";
var users = await listUsersRequest.ExecuteAsync();

foreach (var user in users.UsersValue)
{
    Console.WriteLine(user);
}

服务账号权限配置 #

服务账号分配的自定义管理员角色包含以下权限：

• 查看管理审核日志（Reports Audit Read）
• 查看用户管理审核日志（Reports Audit Read User Management）
• 查看登录审核日志（Reports Audit Read Login）
• 查看令牌审核日志（Reports Audit Read Token）

内容的提问来源于stack exchange，提问作者Alon Shitrit