Using GAM for revoking access for suspected user in GSuite

-Please see the instructions to install and configure GAM for the first time: 
https://github.com/jay0lee/GAM/wiki 

-Use the following GAM commands for deleting the token id for a suspected user:

1. gam print users allfields >> userfile.csv
2. gam csv userfile.csv gam user ~primaryEmail show tokens >> tokens.csv

Look for displayText and scopes and client ID

If you find the suspect :
gam all users delete token clientid <clientid>
or
gam csv userfile.csv gam user ~primaryEmail delete token clientid <clientid>


---------------------------------------------------------------------------------------------