# Administrator Permissions

> [!NOTE]
>
> When the connector is configured using client credentials, the refresh token holds the scopes and permissions.

The service account and impersonated user require Google Workspace roles and OAuth scopes appropriate to the operations you want the connector to perform (account, group, and role aggregation, creation, update, and deletion). At a minimum:

> [!IMPORTANT]
>
> The impersonated user must be the IAM user, not the service account.

## Assigning Roles to an Impersonated User

### Manage G-Suite Users/Groups/Roles

To assign the Roles (Built-in/Custom) to an Impersonated User for managing G-Suite Users/Groups/Roles, complete the following:

> [!NOTE]
>
> **Screenshot**
>
> [![Google Workspace User](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/img/g-suite_user.png>)](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/img/g-suite_user.png>)

1. Go to the [Google Admin](<https://admin.google.com/>) page.
2. In the left pane, go to **Directory** and select **Users**.
3. Select the configured **Impersonated user** used as the `jwt subject`.
4. Expand the **Admin roles and privileges** section for that user.
5. Assign the required roles documented in the G-Suite section to this user.

### Manage Google Cloud Resources

To assign the Roles (Built-in/Custom) to an Impersonated User for managing cloud resources when **Manage Cloud Resources** is enabled in SailPoint, complete the following:

> [!NOTE]
>
> **Screenshot**
>
> [![Cloud Resource User](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/img/cloud_resource_user.png>)](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/img/cloud_resource_user.png>)

1. Go to the [Google Cloud Console](<https://console.cloud.google.com/>).
2. Select **IAM &amp; Admin** and verify that you are viewing the Organization configured as the organization ID, such as `dev.sailpoint.com`.
3. Select **Grant Access**.
4. Under **Add Principal**, select the Impersonated User configured as the `jwt subject` during source configuration.