Connect Google Workspace

Imports users, groups, Chrome OS devices, and sign-in logs from your Google Workspace organization.

For the general flow of adding a source, see Connect Data Sources.

Before you start

• Google Workspace account with Super Admin role

• Access to Google Cloud Console

Step 1 — Create the project and enable the Admin SDK API

1. console.cloud.google.com → create or select a project

2. APIs & Services → Library → search Admin SDK API → Enable

   • This API covers both the directory and sign-in logs. Without it, requests fail with 403.

Step 2 — Create a GCP service account

1. IAM & Admin → Service Accounts → Create Service Account

2. Name: harven

3. Keys → Add Key → JSON → download the file

4. Note the service account Client ID

Step 3 — Enable Domain-Wide Delegation

1. Service account details → Enable G Suite Domain-wide Delegation

2. In admin.google.com → Security → API Controls → Domain-wide delegation

3. Add the Client ID with scopes:

   • admin.directory.user.readonly, admin.directory.group.readonly, admin.directory.device.chromeos.readonly, admin.reports.audit.readonly

Step 4 — Remediation actions (optional)

1. Only required to suspend / reactivate a user from HARVEN

2. Add the write scope to the domain-wide delegation:

   • admin.directory.user

   • Without .readonly: read + write access. Omit it if you only use read-only import.

What to enter in HARVEN

• Delegated Email — Super Admin email for impersonation (Your Super Admin account email)

• Service Account Key — JSON content of the downloaded key file (GCP → Service Accounts → Keys → download JSON)

What HARVEN reads

• user — Google Workspace users: identity (userid, name, email, workspace_admin), security (mfa_enabled, last_password_change)

• device — Chrome OS / mobile devices: device (name, manufacturer, model, os, osversion, last_signin)

• signin — Sign-in logs: connection (status, date, application, ip_address, failure_reason)

• group — Google Groups: group (id, name, type)

Official documentation

• Service Account + Domain-Wide Delegation

Need help? Contact [email protected].