diff --git a/rules/cloud/gworkspace/gworkspace_role_modified_or_deleted.yml b/rules/cloud/gworkspace/gworkspace_role_modified_or_deleted.yml
index 9437ca57d..e0bab12fd 100644
--- a/rules/cloud/gworkspace/gworkspace_role_modified_or_deleted.yml
+++ b/rules/cloud/gworkspace/gworkspace_role_modified_or_deleted.yml
@@ -6,7 +6,7 @@ status: experimental
 date: 2021/08/24
 references:
     - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
-    - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings
+    - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
 logsource:
   service: google_workspace.admin
 detection:
@@ -22,4 +22,4 @@ tags:
     - attack.impact
 falsepositives:
  - Unknown
- 
\ No newline at end of file
+