Google Workspace

View as Markdown

Community Platform

runZero imports Google Workspace data to sync and enrich your asset inventory and to give you visibility into users and groups. With Google Workspace data in runZero, unmanaged assets on your network are easier to find. The integration supports the ChromeOS, Mobile, and Endpoint registered asset types.

Requirements

  • Use an existing Google service account or create one in whichever project suits you best.
  • Create and download a key for the service account, and save the JSON file.
  • Enable the Admin SDK and Cloud Identity APIs for the project. Use the search box in the API Library to find each API and enable it.
  • Enable domain-wide delegation in the Google Workspace console.
    • Add a new API client, using the service account’s unique numeric ID as the Client ID.
    • Enable these OAuth scopes for the API client: 
      https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,
https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,
https://www.googleapis.com/auth/cloud-identity.devices.readonly
    • Or enter each OAuth scope individually:
    • https://www.googleapis.com/auth/admin.directory.user.readonly
    • https://www.googleapis.com/auth/admin.directory.group.readonly
    • https://www.googleapis.com/auth/admin.directory.device.mobile.readonly
    • https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly
    • https://www.googleapis.com/auth/cloud-identity.devices.readonly

How to set up the Google Workspace integration

Work through these steps in order:

Step 1: Create a Google Workspace credential

  1. Go to the Credentials page and click Add Credential.
  2. From the Credentials type dropdown, choose Google Workspace Client Secret.
  3. Name the credential, for example Google Workspace.
  4. In the Admin account email field, enter the email address of an administrator account with access to the assets, users, or groups you want to import.
  5. Optionally, enter a Customer ID to import from an organization other than the one your administrator account belongs to. By default, runZero uses the Customer ID associated with the service account.
  6. Click Choose file and upload the service account key file you downloaded from Google Workspace.
  7. If other organizations should be able to use this credential, select the Make this a global credential option. Otherwise, you can grant access per organization.
  8. Save the credential.

Step 2: Choose how to configure the Google Workspace integration

You can run the Google Workspace integration as either a scan probe or a connector task. A scan probe gathers integration data during a scan task, and is useful when you run a self-hosted runZero Platform and your console cannot reach Google Workspace. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync. In most situations, a scheduled connection is the easier way to sync your data from Google Workspace.

Step 3: Activate the Google Workspace integration

With your Google Workspace credential saved, set up a connector task or scan probe to sync your data.

Step 3a: Configure the Google Workspace integration as a connector task

A connection needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero organizes the data.

  1. Activate a connection to Google Workspace. All third-party connections are also available from the integrations page, your inventory, or the tasks page.
  2. Choose the credential you added earlier. If it is missing from the list, confirm that the credential has access to the organization you are working in.
  3. Name the task, for example Google Workspace sync.
  4. Schedule the sync to run once or on a recurring schedule. The schedule starts on the date and time you set.
  5. Choose the site to add your assets to, either an existing site or a new one created when the sync runs. Sites group related assets.
  6. To leave out assets that runZero has not scanned, switch the Exclude unknown assets toggle to Yes. By default, the integration includes assets that runZero has not scanned.
  7. Activate the connection. The sync runs on the schedule you set, and the Scheduled tasks page shows when the next sync will occur.

Step 3b: Configure the Google Workspace integration as a scan probe

  1. Create a new scan task, or select a future or recurring scan task from your Tasks page.
  2. Add or update the scan parameters as needed.
  3. On the Probes and SNMP tab, choose any additional probes to include, set the GoogleWorkspace toggle to Yes, and adjust the default options if needed.
  4. On the Credentials tab, set the GoogleWorkspace toggle to Yes for the credential you want to use.
  5. Click Initialize scan to save the scan task. It runs immediately or at the scheduled time.

Step 4: View Google Workspace assets

After a successful sync, open your inventory to see your Google Workspace assets. They show a Google Workspace icon in the Source column.

To filter for Google Workspace assets, run these queries:

Click into any asset to see its attributes, including those returned by Google Workspace.

Community Platform

Besides enriching asset inventory data, the Google Workspace integration imports details about users and groups. Go to Inventory > Users or Inventory > Groups to view them, and use the query source:googleworkspace to filter your results.

To search and filter those users, see the Users inventory keywords.

Troubleshooting

If you are having trouble with this integration, the questions and answers below may help.

Why is the Google Workspace integration unable to connect?

  1. Check whether the Google Workspace integration is returning any data.
    • Query the inventory rather than the task details to review all the data available from this integration.
    • In some cases, an integration’s configuration limits how much data reaches the runZero console.
  2. Some integrations require specific actions that are easy to overlook. If you miss a step during setup, the integration may not work correctly. Review this page and follow the steps exactly.
  3. If the Google Workspace integration can’t connect, check the task log for errors. Common errors include:
    • 500: server error, unable to connect to the endpoint
    • 404: hitting an unknown endpoint on the server
    • 403: not authorized, likely a credential issue
Updated