Google Workspace

Purpose

The Google Workspace connector collects user, group, 2-Step Verification and admin role evidence for organizations using Google as their identity provider, feeding the same identity controls as Microsoft 365.

Requirements

• Google Workspace domain with Super Admin access to authorize the connector
• A Google Cloud project with domain-wide delegation enabled for the AssurIQ service account
• Outbound HTTPS to googleapis.com from the AssurIQ Cloud Connector

Permissions

• admin.directory.user.readonly — read user accounts and status
• admin.directory.group.readonly — read group membership
• admin.directory.rolemanagement.readonly — read admin role assignments
• admin.reports.audit.readonly — read admin and login audit events
• admin.security.readonly — read 2-Step Verification enrollment

Setup

1. 1
   Create a service account

   In Google Cloud Console, create a service account and enable domain-wide delegation.
2. 2
   Authorize scopes in Admin Console

   In the Google Workspace Admin Console, authorize the service account's client ID for the read-only scopes listed above.
3. 3
   Provide the service account key

   Upload the service account JSON key to AssurIQ's connector wizard; it is stored encrypted.
4. 4
   Select the impersonated admin

   Specify a Super Admin email for API impersonation, as required by domain-wide delegation.
5. 5
   Confirm the first sync

   Verify the connector status reaches Connected and user/group counts match the domain.

Verification

• Connector status shows Connected with a recent sync
• User and group counts match the Workspace Admin Console
• 2-Step Verification enrollment appears under Identity Security

Data collected

• User accounts, suspension state and org unit
• Group membership
• Admin role assignments
• 2-Step Verification enrollment status
• Admin and login audit events

Security model

Access uses a domain-wide delegated service account restricted to the read-only scopes above; AssurIQ never requests scopes that can modify users, groups or mail. The service account key is encrypted at rest and used only over outbound HTTPS.

Common errors

• AIQ-INT-001Integration disconnected
  The connector token expired or was revoked. Data from this system is stale.

Troubleshooting

• If no data returns, confirm the client ID authorization in the Admin Console exactly matches the service account and every scope is listed.
• If audit events are missing, confirm the impersonated admin has access to the Reports API.

Disconnect

1. Disconnect the integration from AssurIQ Integrations.
2. Remove the client ID authorization in the Google Workspace Admin Console.
3. Delete the service account key in Google Cloud Console.