Administer a workspace
This scope is quite special. It grants miscellaneous admin capabilities to the app that requests it, provided the installer is an admin allowed to grant those abilities.
It allows access to team.accessLogs and the SCIM API.
This is not an all-inclusive list of admin token capabilities.