Getting groups for Google Enterprise connection - which scopes do I add?

NB: My Google API has the application type “Internal”, so this isn’t a question of the consent screen requiring verification before it goes live.