Unexpected user alias deletion

Problem

Email aliases are being deleted and when you check the Admin log events they show that an admin is deleting them, however, the admin is not manually deleting the aliases.

Environment

  • Admin console
  • Reporting

Solution

  1. In your Google Admin console.
  2. On the left, click Reporting > Audit and investigation > OAuth log events.
  3. Click on + Add a filter > User > type the admin's email address (the one performing the email alias deletion).
  4. Click on Search.
​ ​ ​ ​ ​ ​ ​ ​ Note: These logs will show any third party app performing API calls to the directory API and this will help to find what app is making the changes on behalf of the admin. 

Cause

The email alias deletion is being performed via API due to a third party app that has been authorized to make changes on behalf of the admin account.