Administrator Permissions

The service account and impersonated user require Google Workspace roles and OAuth scopes appropriate to the operations you want the connector to perform (account, group, and role aggregation, creation, update, and deletion). At a minimum:

Assigning Roles to an Impersonated User

Manage G-Suite Users/Groups/Roles

To assign the Roles (Built-in/Custom) to an Impersonated User for managing G-Suite Users/Groups/Roles, complete the following:

1. Go to the Google Admin page.
2. In the left pane, go to Directory and select Users.
3. Select the configured Impersonated user used as the jwt subject.
4. Expand the Admin roles and privileges section for that user.
5. Assign the required roles documented in the G-Suite section to this user.

Manage Google Cloud Resources

To assign the Roles (Built-in/Custom) to an Impersonated User for managing cloud resources when Manage Cloud Resources is enabled in SailPoint, complete the following:

1. Go to the Google Cloud Console.
2. Select IAM & Admin and verify that you are viewing the Organization configured as the organization ID, such as dev.sailpoint.com.
3. Select Grant Access.
4. Under Add Principal, select the Impersonated User configured as the jwt subject during source configuration.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.