Connect Google Workspace

Imports users, groups and their members, Chrome OS and mobile devices, and sign-in logs from your Google Workspace organization.

For the general flow of adding a source, see Connect Data Sources.

Prerequisites

• Google Workspace account with Super Admin role

• Access to Google Cloud Console

Setup

Step 1 — Create the project and enable the Admin SDK API

1. console.cloud.google.com → create or select a project

2. APIs & Services → Library → search Admin SDK API → Enable

   • This API covers both the directory and sign-in logs. Without it, requests fail with 403.

Step 2 — Create a GCP service account

1. IAM & Admin → Service Accounts → Create Service Account

2. Name: harven

3. Skip the optional role step: the service account needs no GCP role

4. Keys → Add Key → JSON → download the file

5. Note the service account Client ID

Step 3 — Enable Domain-Wide Delegation

1. Service account details → Enable G Suite Domain-wide Delegation

2. In admin.google.com → Security → API Controls → Domain-wide delegation

3. Add the Client ID with these five scopes, as full URLs separated by commas:

   • https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly

   • All five are required: HARVEN requests them together, and Google refuses the token when one is missing from the delegation, so every table fails.

Step 4 — Remediation actions (optional)

1. Only required to suspend / reactivate a user from HARVEN

2. Add the write scope to the domain-wide delegation:

   • https://www.googleapis.com/auth/admin.directory.user

   • Without .readonly: read + write access. Omit it if you only use read-only import.

Fields to fill in HARVEN

Collected data

• user — Google Workspace users: Identity (userid, name, email, org_unit, creation_time), Administration (workspace_admin, delegated_admin), Security (mfa_enabled, two_step_enforced, last_login, suspended, archived)

• device — Chrome OS and mobile devices: Device (name, manufacturer, model, os, osversion, last_signin)

• signin — Sign-in logs: Connection (status, date, application, ip_address, failure_reason)

• group — Google Groups: Group (id, name, email, aliases, non_editable_aliases, direct_members_count)

• group_members — Direct members of each group: Group (group_id, group_email), Member (member_id, member_email, member_type, role, status)

Official documentation

• Service Account + Domain-Wide Delegation

Need help? Contact [email protected].