Connectors Google Workspace
Google Workspace
The Google Workspace connector reads your directory, sign-in and grant activity, Drive sharing, Alert Center and Gemini use across a domain. It reads as a named super administrator through domain-wide delegation. How the connect flow works is on How connectors work.
Who can do it
Connecting needs connections:manage (Manage connections), held by Owner, Admin and Fleet operator. In Google, a super administrator of the domain has to authorise the client ID in the Admin console. Every read is made as that person.
Connect
- Go to Collection › Connectors and choose Connect on Google Workspace.
- Give the connection a Name, and choose Modes (at least one):
- Google Workspace: directory, sign-in and token activity, Drive sharing, Alert Center and admin-console settings.
- Gemini: who used Gemini, where and how, and whether the Gemini app is on for an organisational unit.
- Choose a sign-in method:
- Authorise Oxelone's service account in the Google Admin console. The step shows a Client ID and the Scopes to copy. The hint reads "Security › Access and data control › API controls › Manage Domain Wide Delegation › Add new: paste the client ID and every scope, authorise as a super administrator, then sign in here straight away — Google says the change usually takes minutes and can take up to 24 hours."
- Your own service account key (JSON). Upload a service account key you own, with domain-wide delegation for the same scopes. The hint reads "A service account of your own with domain-wide delegation for the same scopes; name the super administrator it runs as beside it."
- Enter the Super administrator's address (the placeholder is
admin@example.com). The line under it reads "Every read is made as this person, who has to be a super administrator of the domain." Sign in stays off until you do: "Name the super administrator first." - Continue through Check and Rules, then choose Create connection.
On Google's side
Google's steps for domain-wide delegation: in the Admin console go to Menu › Security › Access and data control › API controls, select Manage Domain Wide Delegation, click Add new, enter the service account's client ID, add each OAuth scope, and click Authorize. Google then says "Changes can take up to 24 hours but typically happen more quickly." If multi-party approval is on, another super admin must approve.
Vendor documentation: https://knowledge.workspace.google.com/admin/apps/control-api-access-with-domain-wide-delegation
The scopes to paste, for Oxelone's service account and your own:
https://www.googleapis.com/auth/admin.directory.user.readonlyhttps://www.googleapis.com/auth/admin.directory.group.readonlyhttps://www.googleapis.com/auth/admin.directory.group.member.readonlyhttps://www.googleapis.com/auth/admin.directory.orgunit.readonlyhttps://www.googleapis.com/auth/admin.directory.rolemanagement.readonlyhttps://www.googleapis.com/auth/admin.directory.domain.readonlyhttps://www.googleapis.com/auth/admin.directory.customer.readonlyhttps://www.googleapis.com/auth/admin.directory.user.securityhttps://www.googleapis.com/auth/admin.reports.audit.readonlyhttps://www.googleapis.com/auth/apps.alertshttps://www.googleapis.com/auth/drive.readonlyhttps://www.googleapis.com/auth/cloud-identity.policies.readonlyhttps://www.googleapis.com/auth/admin.directory.userhttps://www.googleapis.com/auth/admin.directory.group.memberhttps://www.googleapis.com/auth/drive
The last three are for actions. The console shows the exact list to copy.
What it reads
Mode: Google Workspace
| Records | What you get |
|---|---|
| People | Every account in the directory: administrator status, suspension, two-step verification and organisational unit. |
| Groups | Every group, its address and how many direct members it has. |
| Group members | Who is in each group, and as what. |
| Organisational units | The organisational-unit tree settings are scoped by. |
| Administrator roles | The roles an administrator can hold, and which are super-administrator roles. |
| Role assignments | Who holds which administrator role, and over what. |
| Domains | The customer's domains and whether each is verified. |
| Third-party app grants | Every OAuth grant a person has given a third-party application, with its scopes. The first 2,000 people, by address. |
| App passwords | Application-specific passwords, and when each was last used. The first 2,000 people, by address. |
| Sign-in events | Sign-ins, failures, challenges and 2-step verification changes, as they happen. |
| Third-party grant events | Every authorisation, revocation and request of a third-party application, as it happens. |
| Admin console changes | Every setting an administrator changed, including the security and application settings this connector cannot read directly. |
| Drive events | Drive activity as it happens: which file, its owner, and how visible it is. |
| Alert Center alerts | Google's own security alerts: leaked passwords, suspicious sign-ins, phishing, DLP violations, admin changes. |
| Admin console settings | The settings the Policy API exposes: 2-step verification enforcement, Drive external sharing, Chat restrictions. |
| Shared drives | Every shared drive in the domain, and the restrictions on it. |
| Drive files | Files each person owns (read as that person, the first 200 people, up to 500 files each) and every shared drive holds, with how widely each is shared. Nothing is opened. |
| Drive changes | What changed in each person's Drive since the last sync, read as that person. The first 200 people, by address. |
Mode: Gemini
| Records | What you get |
|---|---|
| Gemini activity | Who used Gemini, in which app, through which feature. Never what was asked. |
| Gemini app settings | Whether the Gemini app and NotebookLM are on, per organisational unit or group. |
What it can do
| Action | Consequence | Reversible |
|---|---|---|
| Suspend the person | The person is signed out and cannot sign in until an administrator unsuspends them. | Yes |
| Sign out everywhere | Every web and device session ends and the person has to sign in again. | No |
| Revoke the application's access | The application loses every access token this person granted it. | No |
| Revoke the app password | The app password stops working; the person makes a new one if they still need it. | No |
| Remove from the group | The person loses whatever this group grants. | No |
| Remove the link or outside share | The file stops being reachable through the link, or by the person or domain outside yours. | No |
What it checks
Nineteen posture checks, no inspections.
| Rule | Severity | Action offered |
|---|---|---|
| Person without 2-step verification | High | None |
| 2-step verification not enforced for a person | Medium | None |
| Super administrator | Low | None |
| Suspended person with a third-party grant | Medium | Revoke the application's access |
| Grant to an application not registered with Google | Medium | Revoke the application's access |
| Grant with full Drive access | Medium | None |
| App password unused for 90 days | Low | Revoke the app password |
| File open to anyone with the link | High | Remove the link or outside share |
| File shared outside the domain | Medium | Remove the link or outside share |
| Unverified domain | Low | None |
| Gemini app on | Low | None |
| NotebookLM on | Low | None |
| 2-step verification not enforced | High | None |
| Drive external sharing allowed | Medium | None |
| Suspicious sign-in | High | None |
| 2-step verification turned off | Medium | None |
| 2-step verification setting changed | Medium | None |
| Third-party application trusted | Medium | None |
| High-severity Alert Center alert | High | None |
What it needs to be Readable
The domain must have authorised the client ID for the scopes above, and the Super administrator you named must be a super administrator there. A kind the scopes do not reach shows Not readable with its reason on Check.
Sync period
1 h, 6 h and 1 d. There is no 15-minute period.
When it goes wrong
| What you see | What it means |
|---|---|
the domain of address has not authorised Oxelone's service account for the scope it asked, or address is not a super administrator there. Nothing was changed. Authorise the client ID with every scope under Manage Domain Wide Delegation, wait a few minutes, and try again. | Google refused the delegated sign-in. address is the super administrator you named. With your own key file it reads "this service account" in place of "Oxelone's service account". |
| A global admin has not registered the sign-in client Google needs to prove who is connecting, so Oxelone's service account is not offered for Google Workspace. Connect with your own service account's key file instead. | Oxelone's service account cannot be used yet. |
| Name the super administrator first. | Sign in is off until the field is filled. |
With the API
Not available with an API key.