usertasksDocs
Sign in

Governance and security

Google Workspace

Sync users, groups and nested group membership from Google Workspace with a service account and domain-wide delegation.

Set up

  1. In Google Cloud, create a service account and a JSON key for it.
  2. In the Google Admin console, Security → Access and data control → API controls → Domain-wide delegation, add the service account's client id with these scopes:
    • https://www.googleapis.com/auth/admin.directory.user.readonly
    • https://www.googleapis.com/auth/admin.directory.group.readonly
    • https://www.googleapis.com/auth/admin.directory.group.member.readonly
  3. In Settings → SSO & Directory → Google Workspace → Connect, paste the JSON key and the email of a Workspace admin for the service account to act as. Optionally limit the sync to one domain.

The key is encrypted and never shown again (or store it in your secret manager and enter secret://tenants/<workspace id>/google-key).

What is synced

  • Users of the customer (or the domain): primary email, full name; suspended and archived users are inactive. A users query (user_query, e.g. orgUnitPath=/Engineering) narrows the set.
  • Groups become teams; membership includes members of nested groups (derived membership), users only.
  • Linked users no longer returned lose access on the next sync (deprovision_missing, on by default).

Sign-in is separate: use the Google OIDC preset with built-in auth, or Google in Supabase Auth.