Google Scopes/Permissions are specified in a few places:
We have a verified and approved Google app for OAuth as well as the Google Workplace Marketplace. This is great. But....
If I want to add some more functionality is there a way to ask for additional permissions without the app being unverified and removed from the Google Workplace Marketplace??
How do apps with millions of users deal with this? Do they really just have a week long downtime while they go through the the approval process?
I guess I'm just curious what triggers a reapproval and what are Google's expectations for us to add new fun features.
I recently made a small change that needed some additional permissions and the app was sent back to unverified and removed from the Google Workplace Marketplace.
Am I even able to edit/modify our Google Marketplace listing description and content without a removal and re-approval?
To add a new scope first add it to the OAuth Consent Screen and get it approved. This won't change the Marketplace app, so users won't be asked to grant the new scope and they won't see the unverified app screen. Once it's approved add the scope in the Google Workspace Marketplace SDK and in the implementation (Apps Script, server side).
Currently the only changes that trigger a re-review is when you add or remove an integration, but this may change in the future. You can create a ticket letting the review team know that you are going to make such a change so that they can prioritize the re-review, see https://developers.google.com/workspace/marketplace/list-multiple-app-integrations#add_app_integrations_to_an_existing_app_listing
There's some work in progress that will simplify this process, stay tuned!