您需要授予服务帐户的客户ID访问管理员设置API范围的权限.遵循驱动器域范围内的授权说明，但正确范围内的子目录除外.然后，您可以设置sub =且没有错误.

You need to grant your service account's client ID access to the scopes for admins settings API. Follow the Drive domain wide delegation instructions except sub in the correct correct scope. Then you can set sub= without an error.