Google SecOps OAuth Scope Write Permissions Deprecated

According to the Google Cloud Release Notes dated September 11, 2026, Google has announced the deprecation of write permissions from the chronicle.readonly OAuth scope for Google SecOps and Google SecOps SIEM. Effective January 25, 2027, this scope will be restricted strictly to read operations. Users are advised to update any workflows that currently perform write operations using chronicle.readonly to instead use the chronicle OAuth scope.

Operators should review all workflows, scripts, and integrations that rely on the chronicle.readonly OAuth scope to ensure compliance with this change before the deprecation date. Failure to update workflows could result in write operations failing unexpectedly, potentially disrupting security data pipelines or automation processes. This change aligns with a broader trend of tightening OAuth scope permissions to enhance security and reduce unintended access risks.