Set up a Google Workspace connector

This is an updated and improved version of the Google Workspace integration! If you’re setting up a Google Workspace connector with C1 for the first time, you’re in the right place.

Capabilities

Resource	Sync	Provision
Accounts
Groups
Roles
Enterprise Applications

The Google Workspace connector supports automatic account provisioning and deprovisioning.

Connector actions

Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the Perform connector action automation step.

Action name	Additional fields	Description
update_user_status	`resource_id` (string, required) `is_suspended` (boolean, required)	Suspends or activates a user account
disable_user	`user_id` (string, required)	Suspends a user account (idempotent)
enable_user	`user_id` (string, required)	Unsuspends a user account (idempotent)
change_user_primary_email	`resource_id` (string, required) `new_primary_email` (string, required)	Updates a user’s primary email address
transfer_user_drive_files	`resource_id` (string, required) `target_resource_id` (string, required) `privacy_levels` (string, optional)	Transfers Google Drive ownership from one user to another. Accepts `private` or `shared` for privacy_levels
transfer_user_calendar	`resource_id` (string, required) `target_resource_id` (string, required) `release_resources` (boolean, optional)	Transfers Google Calendar data from one user to another
change_user_org_unit	`user_id` (string, required) `org_unit_path` (string, required)	Moves a user to a different organizational unit
offboarding_profile_update	`user_id` (string, required) `archive_account` (boolean, optional)	Comprehensive offboarding: removes from GAL, clears recovery details, deletes addresses/phones, optionally archives
sign_out_user	`user_id` (string, required)	Signs user out of all sessions and resets sign-in cookies
delete_all_oauth_tokens	`user_id` (string, required)	Revokes all third-party app authorizations
delete_all_application_passwords	`user_id` (string, required)	Deletes all app-specific passwords
create_group	`email` (string, required) `name` (string, required) `description` (string, optional)	Creates a new Google Workspace group
modify_group_settings	`group_key` (string, required) `allow_external_members` (boolean, optional) `allow_web_posting` (boolean, optional) `who_can_post_message` (string, optional) `message_moderation_level` (string, optional)	Update settings for an existing Google Group
update_user_manager	`user_id` (string, required) `manager_email` (string, required)	Updates the manager relation for a user in Google Workspace. Updates the ‘manager’ entry in the user’s Relations field

Before you begin

This connector authenticates with a service account and domain-wide delegation, not per-user OAuth. Every call reaches Google as one service account impersonating a Workspace super admin. You need:

Google Cloud console access to a project where you can enable APIs and create a service account: project Owner, or Editor plus the ability to manage service accounts.
Permission to create a service account key (iam.serviceAccountKeys.create), granted by the Service Account Key Admin role (roles/iam.serviceAccountKeyAdmin). See Allow service account key creation.
A Google Workspace super admin to authorize domain-wide delegation and to act as the impersonated administrator.
Either the Connector Administrator or Super Administrator role in C1.

Check your organization’s key policy first. Google organizations created on or after May 3, 2024 block service account key creation by default. The connector requires a JSON key, so confirm you can create one before you start. See Allow service account key creation.

What the Google Cloud project provides

What	Why it matters
Enabled APIs	The connector calls the Admin SDK and Cloud Identity APIs, plus the Groups Settings API if you use group settings. Each must be enabled in your project.
Service account	The single identity C1 authenticates as. It needs no project IAM role.
JSON key	The credential you upload to C1. Creating one requires the Service Account Key Admin role and an organization policy that permits key creation.
Domain-wide delegation	The Workspace-side grant that authorizes the service account’s scopes. This is what actually lets the connector read and write directory data.

Domain-wide delegation is configured in the Google Admin console, not in Google Cloud. Granting the service account a Google Cloud IAM role does not give it access to Workspace data, and no project role is required for this connector.

Set up the Google Cloud project

This part happens entirely in Google Cloud and needs the Google Cloud permissions listed in Before you begin. The Workspace super admin isn’t needed until Grant domain-wide delegation in Google Workspace. Each section below gives the Google Cloud console steps and the equivalent gcloud commands. Use whichever you prefer. To use the CLI, install the gcloud CLI and run gcloud auth login first.

Create or select a project

Create a new Google Cloud project dedicated to this connector, or select an existing one.

Sign in to https://console.cloud.google.com with an account that can create projects, enable APIs, and manage service accounts.

In the toolbar, open the project select dropdown and click NEW PROJECT.

Create a new project for your organization:

Project Name: Choose a name, such as “C1 Integration”
Organization/Location: Choose the appropriate Organization/Location

After the project is created, make sure the correct project is selected in the dropdown in the toolbar at the top of the page.

From the command line:

gcloud projects create YOUR_PROJECT_ID \
  --name="C1 Integration" \
  --organization=YOUR_ORG_ID

gcloud config set project YOUR_PROJECT_ID

The Workspace APIs this connector uses don’t require a billing account.

Enable the APIs

Enable the Admin SDK API, plus the Cloud Identity API and, if you use group settings, the Groups Settings API.

API	Service ID	Required?	Used for
Admin SDK API	`admin.googleapis.com`	Required	Syncing users, groups, roles, and audit events, and running provisioning and data transfer actions
Cloud Identity API	`cloudidentity.googleapis.com`	Required	Resolving SAML app IDs to stable identifiers when syncing enterprise applications
Groups Settings API	`groupssettings.googleapis.com`	Optional	The `modify_group_settings` connector action

The Admin SDK API covers the Directory, Reports, and Data Transfer APIs. Enabling it once is enough. There is no separate Data Transfer API to enable, even though the connector requests the admin.datatransfer scope.

In the navigation menu, navigate to APIs & Services > Library.

Search for and select the Admin SDK API, then click Enable.

Repeat for the Cloud Identity API.

Optional. If you want to use the group settings connector action, repeat for the Groups Settings API.

From the command line:

gcloud services enable \
  admin.googleapis.com \
  cloudidentity.googleapis.com \
  groupssettings.googleapis.com \
  --project=YOUR_PROJECT_ID

To confirm which APIs are enabled on the project:

gcloud services list --enabled --project=YOUR_PROJECT_ID

Create a service account

Create the service account C1 will authenticate as.

In the navigation menu, navigate to APIs & Services > Credentials.

Select CREATE CREDENTIALS > Service Account.

Under Service account details, fill in the following:

Service account name: C1 Integration
Service account description: for example, “Service account for C1 Google Workspace Integration”
Click CREATE AND CONTINUE

Under Grant this service account access to a project, click CONTINUE without selecting a role. The connector’s access comes from domain-wide delegation, so no project role is required.

Leave Grant users access to this service account blank.

Click DONE.

From the command line:

gcloud iam service-accounts create c1-integration \
  --project=YOUR_PROJECT_ID \
  --display-name="C1 Integration" \
  --description="Service account for C1 Google Workspace Integration"

Earlier versions of this guide granted the service account the Editor role. That role is not needed and grants broad access to your Google Cloud project. If you already granted it, you can safely remove it.

Allow service account key creation

The connector authenticates with a JSON key, so your organization must permit key creation on this service account. The constraints/iam.disableServiceAccountKeyCreation organization policy blocks key creation. Google enforces this policy by default for organizations created on or after May 3, 2024, so new organizations hit it unless an administrator grants an exception. If the policy blocks you, key creation fails with:

ERROR: (gcloud.iam.service-accounts.keys.create) FAILED_PRECONDITION: Key creation
is not allowed on this service account.

In the console, the ADD KEY option is unavailable and Google reports that service account key creation is disabled. Permissions to check:

Requirement	Details
IAM permission	`iam.serviceAccountKeys.create`, granted by the Service Account Key Admin role (`roles/iam.serviceAccountKeyAdmin`). The basic Editor role also includes it.
Organization policy	`constraints/iam.disableServiceAccountKeyCreation` must not be enforced on the project. A managed equivalent, `iam.managed.disableServiceAccountKeyCreation`, controls the same behavior.
Related policies	`constraints/iam.serviceAccountKeyExpiryHours` caps how long new keys stay valid. If your organization sets it, plan to rotate the key in C1 before it expires.

Grant the key admin role to whoever creates the key:

gcloud iam service-accounts add-iam-policy-binding \
  c1-integration@YOUR_PROJECT_ID.iam.gserviceaccount.com \
  --member="user:admin@yourdomain.com" \
  --role="roles/iam.serviceAccountKeyAdmin" \
  --project=YOUR_PROJECT_ID

Check whether the organization policy is enforced on your project:

gcloud org-policies describe iam.disableServiceAccountKeyCreation \
  --project=YOUR_PROJECT_ID \
  --effective

If it is enforced, a user with the Organization Policy Administrator role (roles/orgpolicy.policyAdmin) can add a project-level exception. Save this as policy.yaml:

name: projects/YOUR_PROJECT_ID/policies/iam.disableServiceAccountKeyCreation
spec:
  rules:
  - enforce: false

Then apply it:

gcloud org-policies set-policy policy.yaml

This exception applies only to the project you name. Enforcement elsewhere in your organization is unchanged. If your organization manages exceptions with tags rather than per-project policies, see Google’s Organization policies and tags documentation.

Google recommends against long-lived service account keys and prefers Workload Identity Federation where it’s available. This connector requires a JSON key, so treat it as a sensitive credential: store it in a secrets manager, never commit it to source control, and rotate it on a schedule. See Google’s best practices for managing service account keys.

Create the key and get the unique ID

Generate the service account’s JSON key and record its numeric unique ID, which domain-wide delegation requires.

Navigate back to APIs & Services > Credentials and select the service account you just created.

Click the service account’s email address. Locate and save the Unique ID, a numeric string such as 108123456789012345678. The service account’s details page also shows this value as the OAuth 2 Client ID.

Do not confuse the Unique ID with the service account’s email address. Domain-wide delegation requires the numeric ID.

On the Service account details page, click KEYS.

Click ADD KEY > Create new key.

Choose JSON and click CREATE.

Keep the downloaded file somewhere safe. Google does not let you download it again.

From the command line:

gcloud iam service-accounts keys create c1-credentials.json \
  --iam-account=c1-integration@YOUR_PROJECT_ID.iam.gserviceaccount.com

Retrieve the numeric unique ID you’ll use for domain-wide delegation:

gcloud iam service-accounts describe \
  c1-integration@YOUR_PROJECT_ID.iam.gserviceaccount.com \
  --format='value(uniqueId)'

To review the keys that exist on the service account:

gcloud iam service-accounts keys list \
  --iam-account=c1-integration@YOUR_PROJECT_ID.iam.gserviceaccount.com

Grant domain-wide delegation in Google Workspace

Domain-wide delegation authorizes the service account to call Workspace APIs on behalf of your organization. Configure it in the Google Admin console.

Go to https://admin.google.com as a SUPER ADMIN.

In the navigation menu, select Security > Access and data control > API Controls.

Click MANAGE DOMAIN WIDE DELEGATION.

Click Add new and fill out the form:

Client ID: The service account’s Unique ID
OAuth Scopes: Copy and paste in the relevant scopes from OAuth scopes below

Click AUTHORIZE.

OAuth scopes

Choose one of the two sets below. Read-only access lets C1 sync access data. Read/write access lets C1 sync access data and provision access.

Read-only
Read/write

Paste this comma-separated list into the OAuth Scopes field:

https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.group.member.readonly, https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly, https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.reports.audit.readonly, https://www.googleapis.com/auth/admin.directory.user.security, https://www.googleapis.com/auth/cloud-identity.inboundsso.readonly

Scope	Purpose
`admin.directory.domain.readonly`	Identify the primary domain of the Google Workspace account
`admin.directory.group.readonly`	Read and sync Google Groups
`admin.directory.group.member.readonly`	Read and sync the members of each group
`admin.directory.rolemanagement.readonly`	Read and sync roles and their assignments
`admin.directory.user.readonly`	Read and sync users
`admin.reports.audit.readonly`	Sync usage events and admin events, used with incremental sync
`admin.directory.user.security`	Discover OAuth apps through per-user token listing
`cloud-identity.inboundsso.readonly`	Optional. Resolve SAML app IDs to stable identifiers. Without it, SAML app IDs fall back to display names

Paste this comma-separated list into the OAuth Scopes field:

https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.group.member, https://www.googleapis.com/auth/admin.directory.rolemanagement, https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/admin.reports.audit.readonly, https://www.googleapis.com/auth/admin.datatransfer, https://www.googleapis.com/auth/admin.directory.group, https://www.googleapis.com/auth/admin.directory.user.security, https://www.googleapis.com/auth/apps.groups.settings, https://www.googleapis.com/auth/cloud-identity.inboundsso.readonly

Scope	Purpose
`admin.directory.domain.readonly`	Identify the primary domain of the Google Workspace account
`admin.directory.group.readonly`	Read and sync Google Groups
`admin.directory.group.member`	Write. Manage group memberships, adding or removing users from groups
`admin.directory.rolemanagement`	Write. Manage role assignments, granting or revoking roles
`admin.directory.user`	Write. Provision and deprovision accounts
`admin.reports.audit.readonly`	Sync usage events and admin events, used with continuous sync
`admin.datatransfer`	Write. Transfer user data between Google accounts
`admin.directory.group`	Write. Provision groups
`admin.directory.user.security`	Write. Discover OAuth apps and run actions that remove a user’s access, such as sign out and deleting auth tokens and app passwords
`apps.groups.settings`	Write. Edit group settings. Requires the Groups Settings API
`cloud-identity.inboundsso.readonly`	Optional. Resolve SAML app IDs to stable identifiers. Without it, SAML app IDs fall back to display names

The write scopes let C1 provision and deprovision access. If you don’t want C1 to perform these tasks, use the read-only scope set. Read-only still syncs users, groups, and roles, so it’s sufficient when you use Google Workspace as your directory and run access reviews.

Find your customer ID and primary domain

The connector configuration needs your Google Workspace customer ID and primary domain, both available in the Admin console.

In the Google Admin console, select Account > Account Settings.

Copy the Customer ID from this page.

In the navigation panel on the left, click Account > Domains.

Click Manage Domains. Locate and copy the domain labeled as the Primary Domain in the Type column.

Done. Next, move on to the connector configuration instructions.

Configure the Google Workspace connector

This task requires either the Connector Administrator or Super Administrator role in C1.

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

In C1, navigate to Integrations > Connectors and click Add connector.

Search for Google Workspace v2 and click Add.

Choose how to set up the new Google Workspace connector:

Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app

Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

Click Next.

If you are the connector owner, go on to the next step.
If someone else is the connector owner, you can stop here. C1 will notify the connector owner by email that their help is needed to complete the setup process.

Find the Settings area of the page and click Edit.

In the Customer ID field, enter the Google Workspace customer ID.

Optional. If you want to limit which domains C1 syncs, in the Domain field, enter your primary domain. If you leave this field blank, C1 will sync all available domains.

In the Administrator email field, enter the email address of a Google Workspace super admin. The service account impersonates this user.

In the Credentials (JSON) area, click Choose file and upload the file.

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Google Workspace connector is now pulling access data into C1.

Follow these instructions to use the Google Workspace connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

Official download center: For stable binaries (Windows/Linux/macOS) and container images.
GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new Google Workspace connector

In C1, navigate to Integrations Connectors > Add connector

Search for Baton and click Add

Choose whether to add to an existing application or create new

Set the connector owner(s)

Click Create and add details

In the Settings area, click Edit

Click Rotate to generate a new Client ID and Secret

Save these credentials securely - you’ll need them for the Kubernetes configuration

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Google Workspace connector deployment:

Secrets configuration

# baton-google-workspace-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-google-workspace-secrets
type: Opaque
data:
  # C1 credentials
  BATON_CLIENT_ID: <base64 encoded C1 client ID>
  BATON_CLIENT_SECRET: <base64 encoded C1 client secret>
  
  # Google Workspace specific credentials
  BATON_CUSTOMER_ID: <base64 encoded customer ID>
  BATON_DOMAIN: <base64 encoded domain>
  BATON_ADMINISTRATOR_EMAIL: <base64 encoded administrator email>
  BATON_CREDENTIALS_JSON: <base64 encoded credentials JSON>

  # Optional: include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

Base64 Encoding: Use echo -n "your-value" | base64 to encode your secrets,See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-google-workspace.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-google-workspace
  labels:
    app: baton-google-workspace
spec:
  selector:
    matchLabels:
      app: baton-google-workspace
  template:
    metadata:
      labels:
        app: baton-google-workspace
        baton: true
        baton-app: google-workspace
    spec:
      containers:
      - name: baton-google-workspace
        image: public.ecr.aws/conductorone/baton-google-workspace:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-google-workspace
        envFrom:
        - secretRef:
            name: baton-google-workspace-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the Google Workspace connector to. Google Workspace data should be found on the Entitlements and Accounts tabs.

Done. Your Google Workspace connector is now pulling access data into C1.

Set Google Workspace as your C1 directory

If Google Workspace is your source of truth for who works at your company, designate the connector’s app as your directory. C1 then creates a C1 user for each Workspace account it syncs, and accounts from your other connectors attach to those users.

Importing users and groups doesn’t require provisioning. If all you want is a directory and access reviews, the read-only scope set in OAuth scopes is sufficient, and the service account still needs no Google Cloud IAM role.

Wait for the connector’s first sync to finish. An app becomes available to select only after it has synced at least once.

In C1, navigate to Directory > Directory sources.

On the Directories tab, click Add directory data source.

Select the app your Google Workspace connector is attached to.

Optional. Limit which accounts will be pulled into C1 or configure merge matching. You can change both later.

Click Create directory.

For how directory accounts become C1 users, and how accounts from non-directory apps find an owner, see Connect a directory.

What’s next?

If Google Workspace is your company’s identity provider (meaning that it is used to SSO into other software), the integration sync will automatically create applications in C1 for all of your SCIMed software. Before you move on, review the Create applications page for important information about how to set up integrations with the SCIMed apps.

Troubleshooting the Google Workspace integration

Symptom	Cause	Fix
`FAILED_PRECONDITION: Key creation is not allowed on this service account`	The `iam.disableServiceAccountKeyCreation` organization policy is enforced, or you lack the Service Account Key Admin role.	See Allow service account key creation.
`Error 403: Request had insufficient authentication scopes` / `ACCESS_TOKEN_SCOPE_INSUFFICIENT`	The domain-wide delegation grant is missing scopes the connector needs.	Remove and re-add the API client with the full scope set. See When adding permissions to my Google Workspace API Client permissions I get authorization errors.
`unauthorized_client` when the connector authenticates	The Client ID in domain-wide delegation doesn’t match the service account’s Unique ID, or the requested scopes aren’t authorized.	Confirm you entered the numeric Unique ID, not the service account email, and that the scope list matches exactly.
`SERVICE_DISABLED` or “API has not been used in project … before or it is disabled”	The connector’s API isn’t enabled in the project.	Enable it. See Enable the APIs.
Authentication succeeds but the sync returns no users or `Not Authorized to access this resource/api`	The Administrator email isn’t a super admin, or the Customer ID is wrong.	Confirm both values. See Find your customer ID and primary domain.
The connector worked and then stopped authenticating	The service account key expired under `constraints/iam.serviceAccountKeyExpiryHours`, or someone deleted it.	Create a new key and upload it to the connector.

When adding permissions to my Google Workspace API Client permissions I get authorization errors

Example error:

error using connector deprovision [attempt #3]: error: delete resource failed: googleapi: Error 403: Request had insufficient authentication scopes. Details: [ { "@type": "type.googleapis.com/google.rpc.ErrorInfo", "domain": "googleapis.com", "metadata": { "method": "ccc.hosted.frontend.directory.v1.DirectoryUsers.Update", "service": "admin.googleapis.com" }, "reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT" } ] More details: Reason: insufficientPermissions, Message: Insufficient Permission

To resolve this issue: Remove the Google Workspace API Client, then re-add with the correct permissions.

Copy the Client ID.

Delete the API Client.

Add a new Client ID.

Re-add the relevant scopes from OAuth scopes.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a Google Workspace connector

Capabilities

Connector actions

Before you begin

What the Google Cloud project provides

Set up the Google Cloud project

Create or select a project

Enable the APIs

Create a service account

Allow service account key creation

Create the key and get the unique ID

Grant domain-wide delegation in Google Workspace

OAuth scopes

Find your customer ID and primary domain

Configure the Google Workspace connector

Resources

Step 1: Set up a new Google Workspace connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Set Google Workspace as your C1 directory

What’s next?

Troubleshooting the Google Workspace integration

When adding permissions to my Google Workspace API Client permissions I get authorization errors

​Capabilities

​Connector actions

​Before you begin

​What the Google Cloud project provides

​Set up the Google Cloud project

​Create or select a project

​Enable the APIs

​Create a service account

​Allow service account key creation

​Create the key and get the unique ID

​Grant domain-wide delegation in Google Workspace

​OAuth scopes

​Find your customer ID and primary domain

​Configure the Google Workspace connector

​Resources

​Step 1: Set up a new Google Workspace connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

​Set Google Workspace as your C1 directory

​What’s next?

​Troubleshooting the Google Workspace integration

​When adding permissions to my Google Workspace API Client permissions I get authorization errors

Capabilities

Connector actions

Before you begin

What the Google Cloud project provides

Set up the Google Cloud project

Create or select a project

Enable the APIs

Create a service account

Allow service account key creation

Create the key and get the unique ID

Grant domain-wide delegation in Google Workspace

OAuth scopes

Find your customer ID and primary domain

Configure the Google Workspace connector

Resources

Step 1: Set up a new Google Workspace connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Set Google Workspace as your C1 directory

What’s next?

Troubleshooting the Google Workspace integration

When adding permissions to my Google Workspace API Client permissions I get authorization errors