Here is a code to repro and screenshots to demonstrate the impersontead user permissions

The readUser is working but not the updateUser => why ?

Please note that I have waited 1 day between the setup of the accounts and to post this question, so this is not due to a propagation time issue

[Fact]
public async Task TestReadAndWriteRawGoogleLibrary()
{
    var jsonCreds = File.ReadAllText("./../../../../key.json");
    var impersonatedUserEmail = "xxx"; //hidden for confidentaility
    var credential = GoogleCredential.FromJson(jsonCreds)
           .CreateScoped(DirectoryService.Scope.AdminDirectoryUser)
           .CreateWithUser(impersonatedUserEmail);
    var service = new DirectoryService(new BaseClientService.Initializer()
    {
        HttpClientInitializer = credential,
        ApplicationName = "test",
    });
    var request = service.Users.Get("[email protected]");
    request.Projection = UsersResource.GetRequest.ProjectionEnum.Full;
    var u = await request.ExecuteAsync(); 
    Assert.Equal("XXX", u.Name.FamilyName); //this is working

    await service.Users.Update(u, u.Id).ExecuteAsync(); //this is not working
}

The error is

  Message: 
Google.GoogleApiException : The service admin has thrown an exception. HttpStatusCode is Forbidden. Not Authorized to access this resource/api

  Stack Trace: 
ClientServiceRequest`1.ParseResponse(HttpResponseMessage response)
ClientServiceRequest`1.ExecuteAsync(CancellationToken cancellationToken)
ClientServiceRequest`1.ExecuteAsync()
DirectoryServiceClientTests.TestReadAndWriteRawGoogleLibrary() line 75
--- End of stack trace from previous location ---

key.json contains a service account

the service account has domain-wide delegation

the impersonated user has a role “Api access”

the role “Api access” has the permissions to update a user