Connect Google Workspace

A Google Workspace source reads the client’s users, groups and organizational units. The client’s Google Workspace administrator grants ConnectActive read-only access once, in the Google Admin console, and you give ConnectActive the email address of an administrator to act for.

Open the company’s Settings. Under Sync Sources, the Google Workspace source shows two steps.

Step A: grant the permissions in Google

1. Signed in to Google as an administrator of the client’s Google Workspace, open Domain-wide Delegation in the Google Admin console (https://admin.google.com/ac/owl/domainwidedelegation). Check the initial in the top right corner: you must be in the client’s Google Workspace, not your own.
2. Click Add new.
3. Enter the Client ID the panel shows: 112731746857857481915.
4. Add the OAuth scopes the panel lists. The clipboard icon next to them copies all seven at once:
   • https://www.googleapis.com/auth/admin.directory.user.readonly
   • https://www.googleapis.com/auth/admin.directory.group.readonly
   • https://www.googleapis.com/auth/admin.directory.group.member.readonly
   • https://www.googleapis.com/auth/admin.directory.orgunit.readonly
   • https://www.googleapis.com/auth/admin.directory.customer.readonly
   • https://www.googleapis.com/auth/admin.directory.domain.readonly
   • https://www.googleapis.com/auth/admin.reports.audit.readonly
5. Click Authorize.

Every scope ends in readonly: ConnectActive cannot change anything in the client’s Google Workspace.

Step B: give the administrator’s email address

1. Enter the email address of an administrator of the client’s Google Workspace.
2. Click Save (or Verify if the address is already saved).
3. The panel says Congratulations! Google Workspace Integration completed successfully. Click Perform Sync Now to run the first sync (Review and commit a sync).

If it fails, the panel shows the reason. Check that the Client ID and all seven scopes were saved in Step A, and that the address belongs to an administrator of the same Google Workspace.

How Google Workspace users are synced

• A user’s username is their primary email address.
• Organizational units work like Active Directory OUs: you can filter by OU, map OUs to an addition and map OUs to sites.
• Changes in the client’s Google Workspace usually start a sync within minutes, besides the daily sync.

To remove ConnectActive’s access, the client deletes the Client ID’s entry under Domain-wide Delegation.