Connect Google Workspace

Before you start

You need the Google Workspace super administrator admin rights described below, and in Trusterio the right to manage integrations (owners and admins have it). Anybody else sees the page read-only.

Connect it

1. Open Automation and choose Connect on the Google Workspace super administrator card. (The link opens the dialog straight away.)
2. Give it a name under What to call it, and read What to grant: every permission and what it is for.
3. Press Add it and enter the credential. You land on the connection’s own page.

You do not need to use Google Cloud. Google lets another system read Workspace only through a service account, and a service account lives in a Google Cloud project. A new project made for this is enough: it is free, needs no billing account, and nothing runs in it. Your Workspace admin login can create it at console.cloud.google.com.

In Google Cloud and the Admin console

1. In a Google Cloud project: APIs & Services → Library → Admin SDK API → Enable. Without it Google refuses every call.
2. Create a service account (it needs no Cloud role), then Keys → Add key → JSON. If adding a key is blocked, your Google Cloud organisation forbids keys by default, which it does for organisations created since May 2024: an Organization Policy Administrator has to allow it for this project.
3. On the service account, Show advanced settings → Domain-wide delegation: copy the Client ID, the long number.
4. In the Admin console: Security → Access and data control → API controls → Manage Domain Wide Delegation → Add new, with that Client ID.
5. Give it exactly these scopes: https://www.googleapis.com/auth/admin.directory.user.readonly and https://www.googleapis.com/auth/admin.reports.audit.readonly.

In Trusterio

Fill in Customer ID (it starts with C; find it under Account → Account settings → Profile in the Admin console), Data region, the Service Account JSON, and Admin Email: an administrator for the service account to act as, a super administrator or an admin role that can read users and reports. Press Save credentials. Google can take up to 24 hours to apply new scopes.

What it checks

• Two-step verification enforced for admins (super and delegated) and for everybody
• Audit logging on. If the audit scope is missing, the check says so as an error rather than failing.

Five settings are listed for you to check yourself, because Trusterio does not read them yet: external Drive sharing, password length, session length, data region and less secure apps. Each says where to look in the Admin console.

After it is connected

• Press Sync now for the first reading. The Tests tab shows each check: what it should be, what was found, and what is affected.
• New connections are read by hand until you choose a schedule: in Monitoring, on the Collection tab, pick Every hour, Every 6 hours, Daily or Weekly.
• The page says when it was last read and its health; Sync History keeps every run.

A connection marked Beta on the Automation screen has not been tried on a real account yet: its permission list is our reading of the provider’s documentation. AWS, Azure, Google Cloud and Jira have been. If a permission is wrong, tell us.

Disconnect

On the connection’s page, choose Disconnect. Reading stops and its credentials are deleted; its history, checks and evidence stay. Then remove what you created at the provider:

• Remove the domain-wide delegation entry in the Admin console.
• Delete the service account or its key.