Google Workspace

Connect Workspace users, groups, directory data, and privileges to Superviso.

The Google Workspace connector supports Identity Source synchronization and Identity & Access collection. It uses a service account with domain-wide delegation to read the selected Workspace directory.

Required values

Service Account - Client Email and Service Account - Private Key
User Email (administrator) used for delegated directory access
Customer ID for the Workspace account
Optional group email prefixes for Identity Source and privilege collection

Required access

Authorize these read-only Google Admin SDK scopes for the service account:

admin.directory.group.readonly
admin.directory.group.member.readonly
admin.directory.rolemanagement.readonly
admin.directory.user.readonly

Use the optional prefixes when only a defined subset of groups should participate in synchronization.

Before you start

Create the credentials listed above in the provider’s administration tools.

Configure in Superviso

Open Settings → Connectors and choose Add connector.
Select Google Workspace from Provider.
Associate the intended asset, or use the new-asset option when appropriate. Enable only the supported synchronization options you need.
Enter the service-account email and private key, delegated administrator email, and Customer ID. Review the optional Identity Source and privilege group prefixes and Groups as privileges filter.
Recheck the required privileges, scope, and filters, then choose Create connector. Resolve any validation errors shown by the form.
Open the saved connector, choose Sync connector when available, and confirm the synchronization scope.
Open Logs, wait for execution to finish, and inspect the result and any errors. Open the relevant Identities, Privileges, or Resources page for the enabled integration to verify collected records.

For authoritative user synchronization, follow Identity Source before enabling that option. Keep the source inactive while validating the expected population; a manual synchronization still applies user and membership changes. SSO sign-in is configured separately.

Unsaved Google Workspace connector setup with synchronization options and blank credential fields. — Select Google Workspace and review its supported options before entering your own credentials. Select the image to view it full size.

Expected outcome

The connector is saved for Google Workspace with the intended integration and collection scope. Synchronization logs show progress, results, and imported records.

If setup or synchronization fails

Check the exact account or organization identifier, required form values, credential validity, granted access, and selected filters. Inspect the failed log’s details before retrying. If only some records are missing, check their scope and provider permissions. For synchronization status and source-managed fields, see Connectors and synchronization logs.

Back to Providers