# SailPoint Google Workspace SaaS Connector Documentation > Google Workspace SaaS Connector Documentation # Documentation # Configuring Additional Google Workspace SaaS Settings ## Advanced Settings Provide the settings for your aggregation. After you select **Advanced Settings**, the following page displays. > [!NOTE] > > **Screenshot** > > [![Advanced Settings]()]() 1. (Optional) Enter a **Domain Name** to aggregate from only a single Google Workspace domain in your organization. The connector supports and manages multi-domain environments. If you want to aggregate from all domains, leave this field empty or remove the domain name that was previously entered. 2. (Optional) Select **Delta Aggregation** to toggle enable or disable this feature. If you enable delta aggregation, the aggregation only includes changes since the last aggregation. Refer to [Configuring Delta Aggregation](<#configuring-delta-aggregation>) for more information. 3. (Optional) Use the **Account Filter** field to configure the scope of user records during full and delta account aggregation. This filter is only applicable for user accounts and not for service accounts or domains. For example, to filter out suspended users, enter `isSuspended=false` as an Account Filter entry. For more information about the filter syntax, refer to [Search for users]() in the Google documentation. > **Note** > > The Google documentation is not maintained by SailPoint, and is subject to change without notice. 4. Select **Save**. ### Improving Aggregation Performance You can configure the following optional attributes to improve aggregation performance when using the Google Workspace SaaS connector: > [!NOTE] > > Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint REST APIs. #### Configuring `isSkipAlias` The number of API calls can be reduced during account aggregation by setting the `isSkipAlias` attribute to `true`. By default, this attribute value is `false`, which means one API call per user is required to fetch aliases. This has a greater risk of exhausting the daily limit of API calls and adversely affects account aggregation performance. When `isSkipAlias` is set to `true`, it saves one API call per user, improving account aggregation performance and reducing the number of API calls. Set the attribute value using: - Key - `connector_isSkipAlias` - Value - `true` #### Configuring `skipPreloadingMemberships` You can turn off group membership preloading if the number of group memberships is greater than or equal to the total number of users in your environment. Preloading group memberships means the connector performs account and entitlement aggregation to build a map of group memberships for each account. By default, the value of `skipPreloadingMemberships` is `false`, so the connector preloads group membership. Set the attribute value using: - Key - `connector_skipPreloadingMemberships` - Value - `false` > [!NOTE] > > If set to `true`, the connector skips membership preloading and instead executes many APIs during account aggregation, reducing performance and risking exhaustion of the API call limit. SailPoint recommends only setting this attribute to `true` when the number of groups is greater than or equal to the number of users in your environment. ### Configuring Delta Aggregation > [!IMPORTANT] > > The Google Workspace documentation lists the events that can be configured and fetched during delta aggregation. However, some attributes, such as `isEnrolledIn2Sv`, which corresponds to the event `USER_ENROLLED_IN_TWO_STEP_VERIFICATION`, are not fetched by the Google Workspace API. To define the scope for delta account and group aggregations, refer to [Generating OAuth 2.0 Credentials](). Use [Advanced Settings](<#advanced-settings>) to enable or disable delta aggregation. The Google Workspace SaaS connector retrieves accounts based on Activity Events for delta aggregation. By default, the following events are supported for account delta aggregation: `ADD_NICKNAME, CHANGE_USER_RELATION, CHANGE_USER_ORGANIZATION, CHANGE_USER_IM, CHANGE_LAST_NAME, CHANGE_FIRST_NAME, CHANGE_PASSWORD_ON_NEXT_LOGIN, MOVE_USER_TO_ORG_UNIT, REMOVE_NICKNAME, RENAME_USER, SUSPEND_USER, UPDATE_BIRTHDATE, CHANGE_PASSWORD, UNDELETE_USER, UNSUSPEND_USER, CHANGE_USER_CUSTOM_FIELD` Refer to [Admin Audit Activity Events - User Settings]() in the Google Workspace documentation for more information on events. > [!NOTE] > > Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint REST APIs. ### Configuring Additional REST Parameters > [!NOTE] > > Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community for more information on SailPoint REST APIs. The connector supports a configurable page size for Group and Role by adding the following entries through the REST API: #### `groupPageSize` Number of records per page for Group Aggregation. The default value is the value provided in the **Page Size** field. Refer to [Advanced Settings](<#advanced-settings>) for more information. The maximum value is 200. #### `rolePageSize` Number of records per page for Role Aggregation. The default value is the value provided in the **Page Size** field. Refer to [Advanced Settings](<#advanced-settings>) for more information. The maximum value is 100. The connector supports account type configuration using the `accountTypes` attribute, which creates a list of account types you want to manage. If provided, Account Aggregation aggregates according to the configured list. By default, the connector aggregates all three account types (`users`, `serviceAccount`, and `domain`). - `fetchCustomIamRolesOnly` - Boolean/String. Fetches only custom roles during aggregation when set to `true`. It skips predefined roles. Requires a SailPoint CIEM license. - `aggregateGARolesOnly` - Boolean/String. Fetches generally available roles during aggregation when set to `true`. It skips roles in stages such as alpha and beta. Requires a SailPoint CIEM license. - `iamRoleView` - String. Possible values are `FULL` or `BASIC`. `FULL` is the default, which brings all permissions along with roles. `BASIC` skips the `includedPermission` attribute. Requires a SailPoint CIEM license. - `iamRolePageSize` - Page size for the role API. The default is 300. The maximum is 1,000. Requires a SailPoint CIEM license. - `serviceAccountPageSize` - Page size for the Service Account API. The default is 100. The maximum is 500. - `assetSearchPageSize` - Page size for the Cloud Asset API. The default and maximum are 500. When GCP support is enabled, the connector fetches both searchable resource types, `cloudresourcemanager` and `iam`, by default. To limit the number of entitlements, configure the connector to fetch one or the other by setting `searchableResourceTypes` to `iam` (Service Accounts) or `cloudresourcemanager` (Organization, Folders, and Projects) through the REST API. To fetch `iamResourcePermission` for only the `iam` resource type, which consists of Service Accounts, use the following PATCH body: ```json [ { "op": "add", "path": "/connectorAttributes/searchableResourceTypes", "value": "iam" } ] ``` To fetch `iamResourcePermission` for only the `cloudresourcemanager` resource type, which consists of Organizations, Folders, and Projects, use the following PATCH body: ```json [ { "op": "add", "path": "/connectorAttributes/searchableResourceTypes", "value": "cloudresourcemanager" } ] ``` ## Activity Insights Settings Ensure the Google Workspace application has the scopes required for Activity Insights. Refer to [Additional SaaS Requirements]() for the required scopes. SailPoint pulls in activity data in the form of events like user logins, password changes, and content updates within the application. You can view an identity’s activity data within an application to discover trends for that user. > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](). Activity Insights Settings allows you to gather account information and activity data from Google Workspace. To enable Activity Insights for the Google Workspace application, refer to [Prerequisites]() for more information. To configure Activity Insights, complete the following: > [!NOTE] > > **Screenshot** > > [![Activity Insights Settings]()]() 1. Go to **Activity Insights Settings**. 2. Select **Enable Activity Insights** to view access to data insights on source and application activity such as logins and other app-specific events. 3. Select **Save**. ## CIEM Settings SailPoint's Cloud Infrastructure Entitlement Management (CIEM) enhances identity governance by providing a deeper view into the effective access of entitlements to resources and your users' entitlement activity in your cloud infrastructure. > [!IMPORTANT] > > You must have a CIEM license to enable cloud governance features. Contact your SailPoint Customer Success Manager to request access. Refer to [CIEM Overview]() for more information. SailPoint CIEM settings allow you to collect cloud resource data and display the total access an identity has to your cloud systems. > [!NOTE] > > SailPoint's CIEM only supports Service Account as a grant type. Refer to [Service Account Authentication Settings]() for more information. To configure CIEM: 1. Go to **CIEM Settings**. 2. Select **Enable Cloud Infrastructure Entitlement Management (CIEM)** to view access to cloud resources and infrastructure granted through entitlements. 3. Enter the **Google Organization ID** to govern your cloud environments within Google Workspace. You can find this ID in Google's Business Profile Manager. Refer to [View organization ID and other details]() in the Google documentation. 4. Enter the **Instance IDs** used to resolve Google Workspace accounts with federated IAM roles within AWS. Separate multiple entries with a comma. 5. Select **Save**. ## Machine Identity Governance Settings > [!NOTE] > > Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric]() for more information. Vertex AI is a unified machine learning (ML) platform on Google Cloud that streamlines the development, training, and deployment of ML models and AI applications. It provides a comprehensive set of tools for the entire ML lifecycle, from data preparation to model deployment and management, enabling data scientists and engineers to collaborate and scale their AI solutions. Vertex AI Agent is a platform within [Google Cloud's Vertex AI]() that enables developers to build and deploy AI-powered agents, specifically for conversational experiences and complex tasks. It provides tools and services for the entire agent lifecycle, from design and development to deployment and management. Agent Registry is the Google Cloud inventory of registered agents. It includes Vertex AI agents, Gemini Enterprise agents, and manually registered agents. ### Prerequisites Before you configure agent governance in the connector, set the agent governance policies that control how the connector handles these accounts. At the project level, enable the following APIs: - Cloud Asset API - Vertex AI API - Agent Registry API ### Aggregation Settings 1. Enter the **Google Organization ID**, which is the unique numeric identifier for your organization resource. 2. In **Regions**, enter each GCP location the connector should search for agents, such as `us-central1`. Press **Enter** after each location. > **Note** > > Gemini Enterprise agents are registered in the `us`, `eu`, or `global` locations. To discover these agents, include the matching locations. 3. (Optional) Choose which agent sources to include: - **Enable GCP Vertex AI Agents**: Adds GCP Vertex AI agents to the GCP Vertex dataset. This option is selected by default. - **Enable GCP Agent Registry**: Adds Agent Registry agents and their skills to the GCP Agent Registry dataset. This option is selected by default. 4. (Optional) If **Enable GCP Agent Registry** is selected, choose which Agent Registry agents to manage: - **Manage Gemini Enterprise Agents**: Selected by default. - **Manage Vertex AI Agents**: Select this to also include Vertex AI agents from Agent Registry. It's cleared by default because the GCP Vertex dataset already aggregates these agents. Selecting it may create duplicates. > **Note** > > Manually registered agents are always included, whatever you select here. 5. Select **Save**. The connector discovers agents in the organization and regions you entered, and adds them to the datasets you selected. Refer to [Google Workspace Datasets and Resources]() for supported resources and datasets. Refer to [GCP Agent Registry Agent]() for more information about Agent Registry agents. Refer to [GCP Agent Registry Skill]() for more information about Agent Registry skills. # Administrator Permissions > [!NOTE] > > When the connector is configured using client credentials, the refresh token holds the scopes and permissions. The service account and impersonated user require Google Workspace roles and OAuth scopes appropriate to the operations you want the connector to perform (account, group, and role aggregation, creation, update, and deletion). At a minimum: > [!IMPORTANT] > > The impersonated user must be the IAM user, not the service account. ## Assigning Roles to an Impersonated User ### Manage G-Suite Users/Groups/Roles To assign the Roles (Built-in/Custom) to an Impersonated User for managing G-Suite Users/Groups/Roles, complete the following: > [!NOTE] > > **Screenshot** > > [![Google Workspace User]()]() 1. Go to the [Google Admin]() page. 2. In the left pane, go to **Directory** and select **Users**. 3. Select the configured **Impersonated user** used as the `jwt subject`. 4. Expand the **Admin roles and privileges** section for that user. 5. Assign the required roles documented in the G-Suite section to this user. ### Manage Google Cloud Resources To assign the Roles (Built-in/Custom) to an Impersonated User for managing cloud resources when **Manage Cloud Resources** is enabled in SailPoint, complete the following: > [!NOTE] > > **Screenshot** > > [![Cloud Resource User]()]() 1. Go to the [Google Cloud Console](). 2. Select **IAM & Admin** and verify that you are viewing the Organization configured as the organization ID, such as `dev.sailpoint.com`. 3. Select **Grant Access**. 4. Under **Add Principal**, select the Impersonated User configured as the `jwt subject` during source configuration. # Configuring Built-In Role Permissions ## Service Account Scopes and Built-In Roles for an Impersonated User The following table lists the minimum Service Account Scopes and Built-In Roles applied to an Impersonated User for the respective connector operations:
Connector Operation Service Account Scopes Impersonate User
Test Connection https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.user.readonly		 No Role
Role related operations(Aggregate Role, Add and Remove Role) https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.rolemanagement
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly		 Super Admin
Create Account with Role https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.rolemanagement
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly		 Super Admin
Refresh Account G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
User Management Admin, Groups Admin, and Super Admin (only required if Role entitlements are managed)

GCP
Cloud Asset Viewer, Service account user, Project IAM Admin, Folder IAM Admin, Organization Administrator (only required if organization level access managed), Service Account Admin, User Management, and Group Admin
Account Aggregation
Create Account with Entitlement(s)
Update Account attribute(s) (For accounts with entitlement)
Add and Remove Entitlement(s)
Partitioning Aggregation
Group Aggregation G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Group Admin

GCP
Cloud Asset Viewer, Organization Administrator (only required if organization level access is managed), Service Account Admin, Folder IAM Admin, and Project IAM Admin
Create and Update Group G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings

GCP
https://www.googleapis.com/auth/cloud-platform
https://www.googleapis.com/auth/iam
Create Account without Entitlement(s) G-Suite
https://www.googleapis.com/auth/admin.directory.user

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
User Management Admin, Super Admin (only required if managing domain as a user)

GCP
Service Account Admin
Enable, Disable, and Delete Account
Update Account attribute(s) (For accounts without entitlement)
Change Password
Delta Aggregation for Account G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.reports.audit.readonly

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
User Management Admin, Groups Admin, Custom Role (Reports), Super Admin (only required if managing domain as a user)

GCP
Cloud Asset Viewer
Delta Aggregation for Group G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.reports.audit.readonly

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Groups Admin and Custom Role (Reports)

GCP
Cloud Asset Viewer
Delete Data Transfer https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user		 User Management, Group Admin, and Data Transfer
DelegatedAdmins https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/gmail.settings.sharing
https://www.googleapis.com/auth/gmail.settings.basic
https://mail.google.com/
https://www.googleapis.com/auth/gmail.modify
https://www.googleapis.com/auth/gmail.readonly		 User Management, Group Admin, and Gmail (Settings)
Aggregation for Folder and Project GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
Cloud Asset Viewer
Aggregation for IAM Role GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
Cloud Asset Viewer and Organization Role Viewer
Create, Update, and Delete IAM Roles GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
Organization Role Administrator
IAM Resource Permission GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
Cloud Asset Viewer, Organization Role Viewer, Organization Administrator (only required if managing Organization level access), Service Account Admin, Folder IAM Admin, and Project IAM Admin
To manage all operations on domain as Account type in GCP https://www.googleapis.com/auth/admin.directory.domain Super Admin
### Additional SaaS Requirements | Connector Operation | Service Account Scopes | Impersonated User Role | | --- | --- | --- | | Agent Aggregation | `https://www.googleapis.com/auth/iam`
`https://www.googleapis.com/auth/cloud-platform` | Vertex AI Viewer, Cloud Asset Viewer | | Agent Registry Aggregation | `https://www.googleapis.com/auth/iam`
`https://www.googleapis.com/auth/cloud-platform` | Agent Registry Viewer | | Activity Insights | `https://www.googleapis.com/auth/admin.reports.audit.readonly`
`https://www.googleapis.com/auth/admin.reports.usage.readonly` | View audit reports and usage reports for your G Suite domain. | # Connecting SailPoint and Google Workspace SaaS To connect SailPoint with Google Workspace, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Actions**. 5. In the **Actions** dropdown list, select the setup method: - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started. > **Note** > > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](). For more information, contact your SailPoint Customer Service Manager. - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup. ### Configuring a Source Using Express Setup Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data. 1. Review the directions and select **Start Express Setup**. 2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**. > **Note** > > The source name must be unique. You can change these settings later in the source configuration. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section. 5. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation. - If you want to aggregate now, select **Aggregate**. - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**. - To see the list of aggregated source accounts, go to **Account Management \> Accounts**. - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet. ### Configuring a Source Using Standard Setup Use Standard Setup to configure the connector for full feature support. 1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 4. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 7. Select **Save**. ## Connection Settings Choose the appropriate authentication type and provide the information required to connect and interact with the source. ### Service Account Authentication Settings > [!NOTE] > > **Screenshot** > > [![Service Account Authentication Settings]()]() 1. Go to **Connection Settings**. 2. In the **Grant Type** menu, select **Service Account**. 3. In the **Email Address of Service Account** field, enter the email address of the service account user. 4. In the **Email Address of User to Impersonate** field, enter the email address of the Impersonate User. This is the user in Google Workspace who has the required access via roles to perform the operations. 5. In the **Scopes** field, enter the scopes to access the Google API. To add more than one scope, use a comma (,) as a separator. For more information on the available scopes, refer to [Generating OAuth 2.0 Credentials](). 6. In the **Private Key** field, enter the encrypted private key generated in [Generating OAuth 2.0 Credentials](). 7. In the **Private Key Password** field, enter the private key password generated in [Generating OAuth 2.0 Credentials](). 8. Select **Save**. ### Client Credentials Authentication Settings > [!NOTE] > > **Screenshot** > > [![Client Credentials Authentication Settings]()]() For information on generating the client ID, client secret, and refresh token, refer to [Generating OAuth 2.0 Credentials](). 1. In the **Grant Type** menu, select **Client Credentials**. 2. Enter the **Client ID** and **Client Secret** of the user application for OAuth 2.0 authentication. 3. In the **Refresh Token** field, enter the value of the refresh token to obtain a new access token. 4. Select **Save**. ## Configuring Additional Settings After establishing the connection, configure optional aggregation, governance, and machine identity settings. Refer to [Configuring Additional Google Workspace Settings](). ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Configuring Custom Role Permissions ## Service Account Scopes and Custom Roles for an Impersonated User Refer to [Creating Custom Roles](<#creating-custom-roles>) for more information. ### Creating Custom Roles To create a custom role in Google Workspace: 1. In the Google Workspace configuration interface, go to **Admin Console \> Menu \> Account \> Admin roles**. 2. Select **Create new role**. 3. Enter the **Name** and **Description** for the role and select **Continue**. To create a custom role in Google Cloud Platform (GCP): 1. Go to **GCP Console \> Roles**. 2. Select **Create Role**. 3. Enter the **Title** and **Description** for the role and select **Continue**. ### Assigning Permissions to Custom Roles Assign the following permissions to the custom role for the service account at the organization level: - `cloudasset.assets.searchAllIamPolicies` - `cloudasset.assets.searchAllResources` - `iam.roles.list` - `iam.serviceAccounts.getIamPolicy` - `iam.serviceAccounts.list` - `logging.logEntries.list` - `resourcemanager.folders.getIamPolicy` - `resourcemanager.folders.list` - `resourcemanager.organizations.get` - `resourcemanager.organizations.getIamPolicy` - `resourcemanager.projects.get` - `resourcemanager.projects.getIamPolicy` - `resourcemanager.projects.list` The following table lists the minimum requirements of Service Account Scopes and Custom Roles applied to an Impersonated User for the respective connector operations.
Connector Operation Service Account Scopes Impersonate User
Test Connection G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Organizational Units (Read), Users (Read)
Admin API Privileges - Organizational Units (Read), Users (Read), Group (Read), Domain Management (only required if managing domain as a user)

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.serviceAccounts.list
Refresh Account
Account Aggregation
Partitioning Aggregation
Role related operations (Aggregate Role, Create Account/Enable/Disable/Change Password/Add and Remove) with Role https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.rolemanagement
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly		 Super Admin
Group Aggregation G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings
https://www.googleapis.com/auth/admin.directory.rolemanagement
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin API Privileges - Group (Read)

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies
Delete group https://www.googleapis.com/auth/admin.directory.group Admin Console Privileges - Groups
Admin API Privileges - Group (Delete)
Create and Update Group G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Groups
Admin API Privileges - Group (Create and Read)

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, resourcemanager.projects.getIamPolicy, resourcemanager.projects.setIamPolicy, resourcemanager.folders.getIamPolicy, resourcemanager.folders.setIamPolicy, resourcemanager.organizations.getIamPolicy, resourcemanager.organizations.setIamPolicy, iam.serviceAccounts.getIamPolicy, iam.serviceAccounts.setIamPolicy
Create Account without Entitlement(s) G-Suite
https://www.googleapis.com/auth/admin.directory.user

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users)
Admin API Privileges - Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Domain Management (only required if managing domain as a user)

GCP
(User-defined Custom Role) - iam.serviceAccounts.create, iam.serviceAccounts.get
Enable, Disable and Delete Account
Update Account attribute(s) (For accounts without entitlement)
Change Password
Create Account with Entitlement(s) G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.rolemanagement

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Group
Admin API Privileges - Groups (Create and Read), Delete, Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users Groups) Cloud Asset Viewer, Project IAM Admin, Folder IAM Admin, Organization Administrator, Service Account Admin

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.serviceAccounts.create, iam.serviceAccounts.get, resourcemanager.projects.getIamPolicy, resourcemanager.projects.setIamPolicy, resourcemanager.folders.getIamPolicy, resourcemanager.folders.setIamPolicy, resourcemanager.organizations.get, resourcemanager.organizations.getIamPolicy, resourcemanager.organizations.setIamPolicy, iam.serviceAccounts.getIamPolicy, iam.serviceAccounts.setIamPolicy
Add/Remove Entitlements
Update Account attribute(s) (For accounts with entitlement)
Delta Aggregation for Account G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.reports.audit.readonly

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Security (Reports), Groups
Admin API Privileges - Groups (Create and Read), Update, Delete (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Groups, Domain Management (only required if managing domain as a user)

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.serviceAccounts.list
Delta Aggregation for Group G-Suite
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/apps.groups.settings
https://www.googleapis.com/auth/admin.reports.audit.readonly

GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 G-Suite
Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Security (Reports), Groups
Admin API Privileges - Groups (Create and Read), Update, Delete, Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Groups

GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies
Delete Data Transfer https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user		 Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Delete
Admin API Privileges - Groups (Create and Read), Update, Delete, Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Delete Data Transfer
Delegated Admins https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/gmail.settings.sharing
https://www.googleapis.com/auth/gmail.settings.basic
https://mail.google.com/
https://www.googleapis.com/auth/gmail.modify
https://www.googleapis.com/auth/gmail.readonly		 Admin Console Privileges - Organizational Unit (Read), Users (Create and Read), Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), Gmail (Settings), Groups
Admin API Privileges - Groups (Create and Read), Update, Update (Rename Users, Move Users, Reset Password, Force Password Change, Add/Remove Aliases, Suspend Users), User Management, Group Admin, Gmail (Settings)
Aggregation for Folder and Project GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources and cloudasset.assets.searchAllIamPolicies
Aggregation for IAM Role GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies, iam.roles.list, resourcemanager.projects.list
Create/Update/Delete IAM Roles GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
(User-defined Custom Role) - iam.roles.create, iam.roles.update, iam.roles.delete, iam.roles.get, iam.roles.list
Aggregation for IAM Resource Permission GCP
https://www.googleapis.com/auth/iam
https://www.googleapis.com/auth/cloud-platform		 GCP
(User-defined Custom Role) - cloudasset.assets.searchAllResources, iam.roles.list, resourcemanager.projects.list, resourcemanager.organizations.getIamPolicy, iam.serviceAccounts.getIamPolicy, resourcemanager.folders.getIamPolicy, resourcemanager.projects.getIamPolicy
To manage all operations on domain as Account type in GCP G-Suite
https://www.googleapis.com/auth/admin.directory.domain		 G-Suite
Admin API Privileges - Domain Management
### Additional SaaS Custom Role Requirements | Connector Operation | Service Account Scopes | User-Defined Custom Role Permissions | | --- | --- | --- | | Agent Aggregation | `https://www.googleapis.com/auth/iam`
`https://www.googleapis.com/auth/cloud-platform` | `aiplatform.agents.get`
`aiplatform.agents.list`
`cloudasset.assets.searchAllResources`
`cloudasset.assets.searchAllIamPolicies` | | Agent Registry Aggregation | `https://www.googleapis.com/auth/iam`
`https://www.googleapis.com/auth/cloud-platform` | `agentregistry.agents.list` | # Dataset Management Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history. > [!NOTE] > > Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric]() for more information. For more information, refer to [Managing Datasets and Resources]() for datasets, resources, owner correlation, and aggregation. ## Datasets A *dataset* is a named group of one or more related resources that the source aggregates together. When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources. > [!NOTE] > > Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them. ### Dataset Aggregation Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](). ## Resources A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model. In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation. For more information, refer to [Managing Resources](). ### Owner Correlation Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](). ## Supported Datasets Go to **Dataset Management \> Datasets** on your Google Workspace SaaS source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation. > [!NOTE] > > Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](). The connector uses datasets to schedule aggregation of the following resource types: | Dataset | Resource Type | Associated Resources | | --- | --- | --- | | Google API Key | Credential | [Google API Key](<#google-api-key>) | | Google API Key Credential | Credential | [Google API Key Credential](<#google-api-key-credential>) | | Google Service Account | Credential | [Google Service Account](<#google-service-account>) | | GCP Workload Identity Federation | Credential | [GCP Workload Identity Federation](<#gcp-workload-identity-federation>) | | GCP Workforce Identity Federated Principals | Account | [GCP Workforce Identity Federated Principal](<#gcp-workforce-identity-federated-principal>), [GCP Workforce Principal Has Role](<#gcp-workforce-principal-has-role>) | | GCP Workload Identity Federated Principals | Account | [GCP Workload Identity Federated Principal](<#gcp-workload-identity-federated-principal>), [GCP Workload Principal Has Role](<#gcp-workload-principal-has-role>) | | GCP Vertex | Agent | [GCP Vertex AI Agent](<#gcp-vertex-ai-agent>) | | GCP Agent Registry | Agent | [GCP Agent Registry Agent](<#gcp-agent-registry-agent>), [GCP Agent Registry Skill](<#gcp-agent-registry-skill>), GCP Agent Registry Agent Uses Skill | ## Supported Resources A resource represents a type of object the connector collects from the connected system, such as service accounts, bots, or agents. Each resource defines the attributes collected for that object type and how each object appears in SailPoint. For more information, refer to [Managing Resources](). > [!NOTE] > > When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources. ### Google API Key | Field | Value | | --- | --- | | Resource ID | `gcp:google-api-key` | | Resource type | `std:credential` | | Identity attribute | id | | Display attribute | id | The following table lists schema attributes for the Google API Key resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | complianceBreach | Compliance control IDs that have been breached. | string | No | Yes | | exposed | Indicates whether the key is externally exposed. | boolean | No | No | | id | Stable token identifier from SailPoint NHI Discovery. | string | No | No | | lastUsedService | The Google API service most recently used by this key. | string | No | No | | ownerEmail | Flattened primary owner email used for owner correlation. | string | No | No | | riskSeverity | Severity band from SailPoint NHI Discovery. | string | No | No | | suspiciousActivity | Whether SailPoint NHI Discovery has flagged suspicious activity for this key. | boolean | No | No | | tags | Tags carried through from the source. | string | No | Yes | ### Google API Key Credential | Field | Value | | --- | --- | | Resource ID | `gcp:api-key-credential` | | Resource type | `std:credential` | | Identity attribute | sailpointId | | Display attribute | sailpointId | The following table lists schema attributes for the Google API Key Credential resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | accountType | The source account type (GCP). | String | No | No | | allowedAndroidApps | The allowed Android package names from Android key restrictions. | String | No | Yes | | allowedIosBundleIds | The allowed iOS bundle IDs from iOS key restrictions. | String | No | Yes | | allowedIps | The allowed IP addresses from server key restrictions. | String | No | Yes | | allowedReferrers | The allowed HTTP referrers from browser key restrictions. | String | No | Yes | | androidApplications | The Android application restrictions, including the package name and SHA-1 fingerprint. | Object | No | Yes | | annotations | The unstructured key-value annotations stored on the API key. | Object | No | No | | apiTargets | The Google APIs the key is allowed to call. | String | No | Yes | | createTime | The timestamp when the API key was created. | String | No | No | | creatorEmail | The primary creator email used for owner correlation. | String | No | No | | deleteTime | The timestamp when the key was soft-deleted. This value is populated for deleted keys and omitted for active keys. | String | No | No | | environment | The environment label derived from project labels, when present. | String | No | No | | etag | The server checksum of the Key resource. | String | No | No | | hasApiRestrictions | Indicates whether the key lists specific API targets (`true` or `false`). | Boolean | No | No | | identity | The unique identifier for the API key, in the format `{projectId}:{uid}`. | String | No | No | | locationId | The Google Cloud location of the API key. API keys are global. | String | No | No | | name | The display name of the API key. | String | No | No | | nhiType | The non-human identity classification. Always set to `GOOGLE_API_KEY`. | String | No | No | | owners | The owner emails from project and organization IAM. | String | No | Yes | | projectDisplayName | The display name of the Google Cloud project that owns the API key. | String | No | No | | projectId | The ID of the project that owns the API key. | String | No | No | | projectNumber | The numeric Google Cloud project number parsed from the key resource name. | String | No | No | | resourceName | The Google Cloud resource name, in the format `projects/{projectNumber}/locations/global/keys/{uid}`. | String | No | No | | resourceUrl | The deep link to the API key credential in the Google Cloud console. | String | No | No | | restrictionType | The client restriction type (`browser`, `server`, `android`, `ios`, or `none`). | String | No | No | | riskSeverity | The restriction-based risk band (`HIGH`, `MEDIUM`, `LOW`, or `UNKNOWN`). | String | No | No | | riskSummary | A short explanation of why the risk severity was assigned, based on API targets and client restrictions. | String | No | No | | sailpointId | The native identity of the API key credential, in the format `{projectId}:{uid}`. | String | No | No | | serviceAccountEmail | The service account the key is bound to, when present. | String | No | No | | Status | The reserved NHI status. `Active` applies to enabled keys. `Deleted` applies to soft-deleted keys. Enabled credentials must have the value `Active`. | String | No | No | | tags | The project labels, stored as key-value strings. | String | No | Yes | | uid | The Google Cloud API key UID. | String | No | No | | updateTime | The timestamp when the key was last updated. | String | No | No | ### Google Service Account | Field | Value | | --- | --- | | Resource ID | `gcp:service-account` | | Resource type | `std:credential` | | Identity attribute | id | | Display attribute | id | The following table lists schema attributes for the Google Service Account credential resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | complianceBreach | Compliance control IDs that have been breached. | string | No | Yes | | exposed | Whether the service account key is externally exposed. | boolean | No | No | | id | Stable token identifier from SailPoint NHI Discovery. | string | No | No | | lastUsedService | Downstream service most recently used by the key. | string | No | No | | ownerEmail | Flattened primary owner email used for owner correlation. | string | No | No | | riskSeverity | Severity band from SailPoint NHI Discovery. | string | No | No | | suspiciousActivity | Whether SailPoint NHI Discovery has flagged suspicious activity for the key. | boolean | No | No | | tags | Tags carried through from the source. | string | No | Yes | ### GCP Workload Identity Federation | Field | Value | | --- | --- | | Resource ID | `gcp:service-account-wif` | | Resource type | `std:credential` | | Identity attribute | id | | Display attribute | id | The following table lists schema attributes for the GCP Workload Identity Federation resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | complianceBreach | Compliance control IDs that have been breached. | string | No | Yes | | exposed | Whether the workload identity federation binding is exposed. | boolean | No | No | | id | Stable token identifier from SailPoint NHI Discovery. | string | No | No | | lastUsedService | Downstream service most recently used by the binding. | string | No | No | | ownerEmail | Flattened primary owner email used for owner correlation. | string | No | No | | riskSeverity | Severity band from SailPoint NHI Discovery. | string | No | No | | suspiciousActivity | Whether SailPoint NHI Discovery has flagged suspicious activity for the binding. | boolean | No | No | | tags | Tags carried through from the source. | string | No | Yes | ### GCP Workforce Identity Federated Principal | Field | Value | | --- | --- | | Resource ID | `gcp:workforce-principal` | | Resource type | `std:account` | | Identity attribute | sailpointId | | Display attribute | sailpointId | The following table lists schema attributes for the GCP Workforce Identity Federated Principal resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | classification | The account classification. Always set to machine. | string | No | No | | externalIdentityRef | The external subject, group, or attribute reference. This field is empty for wildcards. | string | No | No | | impersonatedServiceAccounts | The email addresses of the service accounts this principal can impersonate. | string | No | Yes | | isAdmin | Indicates whether the principal holds an owner, editor, or administrator role (true or false). | boolean | No | No | | location | The location of the identity pool, typically global. | string | No | No | | poolId | The identity pool ID derived from the IAM member path. | string | No | No | | poolResourceName | The full Google Cloud resource name of the identity pool. | string | No | No | | poolType | The type of the identity pool. | string | No | No | | principalScheme | The principal scheme format (principal or principalSet). | string | No | No | | sailpointId | The full IAM member URI starting with `principal://` or`principalSet://`. | string | No | No | | selectorType | The selector type (subject, group, attribute, or wildcard). | string | No | No | | selectorValue | The selector value extracted from the IAM member. | string | No | No | ### GCP Workforce Principal Has Role | Field | Value | | --- | --- | | Resource ID | `gcp:workforce-principal-has-role` | | Resource type | `std:access` | The following table lists schema attributes for the GCP Workforce Principal Has Role resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | identity | The unique identifier for the access link, in the format `{resourceId}#{principal}#{resource}#{role}`. | string | No | No | | linkResolvedBy | The service that resolved this access link. | string | No | No | ### GCP Workload Identity Federated Principal | Field | Value | | --- | --- | | Resource ID | `gcp:workload-principal` | | Resource type | `std:account` | | Identity attribute | sailpointId | | Display attribute | sailpointId | The following table lists schema attributes for the GCP Workload Identity Federated Principal resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | classification | The account classification. Always set to machine. | string | No | No | | externalIdentityRef | The external subject, group, or attribute reference. This field is empty for wildcards. | string | No | No | | impersonatedServiceAccounts | The email addresses of the service accounts this principal can impersonate. | string | No | Yes | | isAdmin | Indicates whether the principal holds an owner, editor, or administrator role (true or false). | boolean | No | No | | location | The location of the identity pool, typically global. | string | No | No | | poolId | The identity pool ID derived from the IAM member path. | string | No | No | | poolResourceName | The full Google Cloud resource name of the identity pool. | string | No | No | | poolType | The type of the identity pool. | string | No | No | | principalScheme | The principal scheme format (principal or principalSet). | string | No | No | | projectNumber | The numeric Google Cloud project that owns the workload identity pool. | string | No | No | | sailpointId | The full IAM member URI starting with`principal://` or `principalSet://`. | string | No | No | | selectorType | The selector type (subject, group, attribute, or wildcard). | string | No | No | | selectorValue | The selector value extracted from the IAM member. | string | No | No | ### GCP Workload Principal Has Role | Field | Value | | --- | --- | | Resource ID | `gcp:workload-principal-has-role` | | Resource type | `std:access` | The following table lists schema attributes for the GCP Workload Principal Has Role resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | identity | The unique identifier for the access link, in the format `{resourceId}#{principal}#{resource}#{role}`. | string | No | No | | linkResolvedBy | The service that resolved this access link. | string | No | No | ### GCP Vertex AI Agent Vertex AI agents discovered through Agent Registry are aggregated in the GCP Agent Registry dataset. Refer to [GCP Agent Registry Agent](<#gcp-agent-registry-agent>) for more information. | Field | Value | | --- | --- | | Resource ID | `gcp:vertex-agent` | | Resource type | `std:agent` | | Identity attribute | identity | | Display attribute | name | The following table lists schema attributes for this resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | identity | Unique identifier for the agent. | string | No | No | | name | The name assigned to the agent. | string | No | No | | projectId | The ID of the project under which the agent resides. | string | No | No | | locationId | The GCP region ID in which the agent resides. | string | No | No | | createTime | The timestamp when the agent was created. | string | No | No | | updateTime | The timestamp when the agent was last updated. | string | No | No | | agentFramework | The open-source agent framework used to develop the agent. | string | No | No | | effectiveIdentity | The resolved runtime identity that the agent executes as. | string | No | No | | spBusinessApplication | Details of the business application linked to the agent. | string | No | No | | serviceAccount | The configured runtime service account for the agent. This field is empty when the default Google Reasoning Engine service agent is used. | string | No | No | | spDescription | The description of the Vertex AI agent. | string | No | No | ### GCP Agent Registry Agent | Field | Value | | --- | --- | | Resource ID | `gcp:agent-registry-agent` | | Resource type | `std:agent` | | Identity attribute | identity | | Display attribute | agentKey | The following table lists schema attributes for this resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | identity | The unique identifier of the agent. | string | No | No | | agentKey | The name shown for the agent. For Gemini Enterprise agents, the name also includes the region and application ID. For other agents, it is the agent name. | string | No | No | | name | The name assigned to the agent. | string | No | No | | agentSource | The application the agent comes from. For example, Google Vertex AI, Gemini Enterprise, or UNKNOWN. | string | No | No | | spBusinessApplication | Details of the business application linked to the agent. | string | No | No | | effectiveIdentity | The resolved runtime identity that the agent executes as. | string | No | No | | uid | The unique ID of the agent in Agent Registry. | string | No | No | | agentId | The permanent identifier of the agent. | string | No | No | | spDescription | The description of the agent. | string | No | No | | projectId | The ID of the project under which the agent resides. | string | No | No | | location | The location where the agent is registered. | string | No | No | | version | The version of the agent. | string | No | No | | protocols | The protocols used to call the agent, with their versions and addresses, as a JSON string. | string | No | No | | skills | The identities of the skills of the agent. | string | No | Yes | | runtimeReference | The resource where the agent runs. | string | No | No | | runtimeIdentity | The identity the agent runs as. | string | No | No | | framework | The framework used to build the agent. | string | No | No | | createTime | The timestamp when the agent was created. | string | No | No | | updateTime | The timestamp when the agent was last updated. | string | No | No | Example protocols value: ```json [{"type":"A2A_AGENT","protocolVersion":"0.3","interfaces":[{"protocolBinding":"JSONRPC","url":"https://example.com/a2a"}]}] ``` Refer to [GCP Agent Registry Skill](<#gcp-agent-registry-skill>) for skill attributes. ### GCP Agent Registry Skill | Field | Value | | --- | --- | | Resource ID | `gcp:agent-registry-skill` | | Resource type | `std:capability` | | Identity attribute | identity | | Display attribute | name | The following table lists schema attributes for this resource: | Attribute | Description | Type | Entitlement | Multi-valued | | --- | --- | --- | --- | --- | | identity | The unique identifier of the skill, in the format `{agent identity}#{skill ID}`. | string | No | No | | skillId | The ID of the skill on the agent card. | string | No | No | | name | The name of the skill. | string | No | No | | type | Capability type: SKILL. | string | No | No | | spDescription | The description of the skill. | string | No | No | | tags | The tags of the skill. | string | No | Yes | | examples | Example requests the skill handles. | string | No | Yes | | projectId | The ID of the project under which the agent resides. | string | No | No | | location | The location where the agent is registered. | string | No | No | # Generating OAuth 2.0 Credentials The following procedures outline how to generate the necessary OAuth 2.0 credentials. > [!NOTE] > > When generating client credentials and service account credentials, use a Google Workspace user who has permission to generate refresh tokens and the required roles or IAM roles to manage Google Workspace and GCP data. Refer to [Prerequisites]() and [Required Roles for Google Workspace and GCP Management](). ## Client Credentials This section describes the procedures for generating the Client ID, Client Secret, and Refresh Token. ### Generating a Client ID and Client Secret 1. Go to **Google Cloud Platform \> APIs & Services \> Credentials**. 2. From the project dropdown list, select an existing project or create a new one. 3. On the **Credentials** page, select **Create Credentials \> OAuth Client ID**. 4. If prompted with a Consent page, select the application type as **Internal**, enter the application name, and save it. 5. Under **Application type**, select **Web application**. 6. Enter an **Application Name**. 7. Under **Authorized redirect URLs**, add the following: ```text https://developers.google.com/oauthplayground ``` 8. Select **Create**. Note the Client ID and Client Secret displayed, as these are required for generating the refresh token. ### Generating a Refresh Token > [!NOTE] > > Before proceeding, ensure you have generated the Client ID and Client Secret. 1. Go to the [OAuth2 Playground](). 2. Select the gear icon in the upper right corner and select the **Use your own OAuth credentials** checkbox (if it is not already selected). 1. Confirm that OAuth Flow is set to Server-side and Access type is set to **Offline**. This ensures that you get a refresh token and an access token. 2. Enter the **OAuth2 client ID** and **OAuth2 client secret** you obtained in the previous step. 3. In **Step 1 - Select & authorize APIs**, enter the required scopes in the text box at the bottom. Use a comma as a separator to add more than one scope. | Scope | Purpose | | --- | --- | | `https://www.googleapis.com/auth/admin.directory.user` | User Provisioning | | `https://www.googleapis.com/auth/apps.groups.settings` | Group Settings API | | `https://www.googleapis.com/auth/admin.directory.rolemanagement` | All role management operations, including creating roles and role assignments | | `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly` | Getting and listing roles, privileges, and role assignments | | `https://www.googleapis.com/auth/cloud-platform`
`https://www.googleapis.com/auth/iam` | Accessing GCP-related data | | `https://www.googleapis.com/auth/admin.directory.domain` | Managing a domain as an account type in GCP | 3. When prompted, sign in to the account that you want to grant access to and select **Allow**. > **Note** > > If a `redirect_uri_mismatch` error states that your changes might not have propagated, select **Back** and try selecting **Authorize APIs** again. 4. On **Step 2 - Exchange authorization code for tokens**, verify that the **Authorization code** is displayed. 5. Select **Exchange authorization code for tokens**. The **Refresh token** and **Access token** fields are displayed. 6. Copy the **Refresh token** into the configuration file for the client library with the Client ID and Client Secret. ## Service Account > [!NOTE] > > SailPoint's Cloud Infrastructure Entitlement Management (CIEM) only supports Service Account as a grant type. A Service Account belongs to the application. Create a service account for the project in the API Console, delegate domain-wide access to the service account, and add the required scopes in the admin console against the service account Client ID. ### Creating a Service Account and Generating a Private Key 1. Sign in to the Google Cloud Platform Console using a user who has the permissions required to generate the private key and manage Google Workspace and GCP data. 2. Go to [Service Accounts](). 3. Select an existing project or create a new project. 4. Select **Create service account**. 5. Enter a name and description for the service account. For example, enter `Project-Service Account`. 6. Select **Done**. 7. Select the email address of the newly created service account. 8. Go to **Keys**. 9. Select **Add key \> Create new key**. 10. Select **JSON**. 11. Select **Create**. The private key downloads to the computer in JSON format. 12. Select **Close**. ### Adding Scopes to the Service Account 1. Sign in to the [Google Admin Console]() as a Super Admin user. 2. Go to **Menu \> Security \> Access and data control \> API controls**. 3. Select **Manage Domain Wide Delegation**. 4. Select **Add new**. 5. Enter the service account client ID. The client ID, also called the Unique ID, is the `client_id` in the downloaded JSON file, for example, `"client_id":"102996919678308170059"`. You can also find it under **IAM & Admin \> Service accounts \> \[your service account\]**. 6. In **OAuth scopes**, enter the required scopes. Use a comma as a separator to add more than one scope. | Scope | Purpose | | --- | --- | | `https://www.googleapis.com/auth/admin.directory.group` | Group Provisioning | | `https://www.googleapis.com/auth/admin.directory.user` | User Provisioning | | `https://www.googleapis.com/auth/apps.groups.settings` | Group Settings API | | `https://www.googleapis.com/auth/admin.directory.rolemanagement` | All role management operations, including creating roles and role assignments | | `https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly` | Getting and listing roles, privileges, and role assignments | | `https://www.googleapis.com/auth/gmail.settings.sharing` | Gmail API provisioning | | `https://www.googleapis.com/auth/cloud-platform`
`https://www.googleapis.com/auth/iam` | Accessing GCP-related data | | `https://www.googleapis.com/auth/gmail.settings.basic`
`https://mail.google.com/`
`https://www.googleapis.com/auth/gmail.modify`
`https://www.googleapis.com/auth/gmail.readonly` | Gmail API aggregation | | `https://www.googleapis.com/auth/admin.directory.domain` | Managing a domain as an account type in GCP | 7. Select **Authorize**. > **Note** > > If an error displays, the client ID might not be registered with Google or the scopes might contain duplicates or unsupported values. 8. Select the new **Client ID**. 9. Select **View details** and verify that each scope is listed. 10. If a scope is missing, select **Edit**, enter the missing scope, and select **Authorize**. You can't edit the client ID. The application should be available within minutes, but availability can take up to 24 hours. ### Assigning Scopes to the Service Account [![Service Account Scopes]()]() 1. Go to [Google Admin](). 2. Go to **Security \> Access and Data Control \> API controls**. 3. Select **Manage Domain Wide Delegation**. 4. Select the service account and assign the applicable scopes documented in this guide. ### Converting a Service Account Private Key to RSA Format 1. Open the downloaded JSON file. 2. Copy the private key value into a new file. For example: ```text -----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDVAm/9T1/yBO2Z\nCCUn9xJbaoFloMUQcQyc7Xd2snXeKSWXGNMmHFPOMTXT4KNCMsxfGPXeHixYcgpu\nPGok/bqJjY9rWncYh8/UUy3gox4fr+J21rj4qCZ5gvOItF7oVKfjk/E4SQrSRvAp\nAc08W3u8vjNAmFoTBeUyEoKuHqCp48N5Gg3pM6htLXMrf2+q+wcv8IwtWAhopoG3\n8XpjAh4+/bff/gkfFoDdIFYwo3IJ5qlU9xawmbZzy3R+8eZTM2WFAkG75lWfX7id\nj87J32EiSe9etCyER9EtaKbxIKC/bww/JKcz3nIWweyXOAX4/tMDs8ThcsztBTa/\npseo4PI1AgMBAAECggEAEsdo+55OkV3lW4c4DV6vH9+TIlRK41DwIXqe/Fgt44Th\no0FFRjgbnFNC0Vfd1MV5No4TCP7EfpSpPkA1xGaZFizkfrymQMOiay/dHM+MpZMC\nRmNWQdfDMpW8pinurxFdjsb5bnKkEVc/L4JQ53gSP9jN2G1GDaTIqMIwgqzBEdER\nHpgrRv1l+MUrJRpyMyh5ZYApihEmFX4XDR2IYa3ZSMkBT4L6MdIcPURBrvVYdV+I\nXGvGWDhPvz/KcjfY7JD8JqVLqSIwgU851gewJJXKpekUS47aYo9Re91+0DB91ZnU\nWhmDmgorVCz90PM7WpKcW/0XkI45yPLWP3elBwsFKQKBgQD7XqKKGf0PChMNlWYV\n1SKEwiFzLipAHzEOJvhXD6v6vskbwqr/xS5j5SvWqpydow9pd2ExCcxmNtlwmpPX\nDXyRu8dmnaXUYCeYBFWheQ+NzlKd2N6wqE5aXrHdwW9xZRcHbyY+dKOv+gFAOQX+\nkakI4bvOcOernhnI6Fnhd94mCQKBgQDY7ukU6/6bVEahhdssakT+trcMOdhiHiPe\nGHaKYy1r3FpmdPmMLeJlECAOFfWqAB0DUiR9hGPXBSB2oIIICCQraQSFV1lu2R+k\nCaV7rFUrvx1b1yeOQDv34/MR6NdjbsjfhPmxSahWaBsvAyx88GRhh0ULgzesEqqk\nZ19PMV/VzQKBgQDrjkU2sR/pRgGQyx28+9u7GMiLzQkeyZwIrRAvVapN8Rc4gnYH\n9NmCFzG7mmnldvZsWMilUY9PgbrFwLUl46eGUbeMO9M4b1rrI7Sy+mVO97eH38Df\nPvkdyntXWXt7gcXQ26G1CUyTDe66JjWt1wXWIuMBk+AlfKShFsuTc+ajMQKBgFNB\nXbLp3409it3ywWsKXfBjr1zB1onRh3J1cQkrhwMeTpOD0UI7WefviF3fj6ju4jOk\nEt0ZMjgTf6IHd+AdP8RpSZLjMy+XpM0P5rLQMN/ZOStGJ6gwftNkaKU293Lx0aX3\nIt0np7OBwO0KCsjoeZ30jEse0P75KwRtp+Z8zIsBAoGAN47TexfJtaEK+ZQBoIn0\nh0mqV1si1QkPfMHSDvriKQ5d5tG8kF0vPVKAQV5kgytBeI+3bEO1iZC8i2FJzL7x\neN8ifRCcNXDRXjRdR0oPVIHImQ0XXwTB6JQmzVIFLWgxddDhZKpCQlA8GSRsbqEe\njtbTjDN0f5sX9llpKxd9xXw=\n-----END PRIVATE KEY-----\n ``` 3. Replace each literal `\n` with a line break. In private key syntax, `\n` denotes a new line. You can make this change in most text editors. For example, in Notepad++, replace each `\\n` with `\n`. The following is an example of the converted key: ```text -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDVAm/9T1/yBO2ZCCUn9xJbaoFloMUQcQyc7Xd2snXeKSWXGNMmHFPOMTXT4KNCMsxfGPXeHixYcgpuPGok/bqJjY9rWncYh8/UUy3gox4fr+J21rj4qCZ5gvOItF7oVKfjk/E4SQrSRvApAc08W3u8vjNAmFoTBeUyEoKuHqCp48N5Gg3pM6htLXMrf2+q+wcv8IwtWAhopoG38XpjAh4+/bff/gkfFoDdIFYwo3IJ5qlU9xawmbZzy3R+8eZTM2WFAkG75lWfX7idj87J32EiSe9etCyER9EtaKbxIKC/bww/JKcz3nIWweyXOAX4/tMDs8ThcsztBTa/pseo4PI1AgMBAAECggEAEsdo+55OkV3lW4c4DV6vH9+TIlRK41DwIXqe/Fgt44Tho0FFRjgbnFNC0Vfd1MV5No4TCP7EfpSpPkA1xGaZFizkfrymQMOiay/dHM+MpZMCRmNWQdfDMpW8pinurxFdjsb5bnKkEVc/L4JQ53gSP9jN2G1GDaTIqMIwgqzBEdERHpgrRv1l+MUrJRpyMyh5ZYApihEmFX4XDR2IYa3ZSMkBT4L6MdIcPURBrvVYdV+IXGvGWDhPvz/KcjfY7JD8JqVLqSIwgU851gewJJXKpekUS47aYo9Re91+0DB91ZnUWhmDmgorVCz90PM7WpKcW/0XkI45yPLWP3elBwsFKQKBgQD7XqKKGf0PChMNlWYV1SKEwiFzLipAHzEOJvhXD6v6vskbwqr/xS5j5SvWqpydow9pd2ExCcxmNtlwmpPXDXyRu8dmnaXUYCeYBFWheQ+NzlKd2N6wqE5aXrHdwW9xZRcHbyY+dKOv+gFAOQX+kakI4bvOcOernhnI6Fnhd94mCQKBgQDY7ukU6/6bVEahhdssakT+trcMOdhiHiPeGHaKYy1r3FpmdPmMLeJlECAOFfWqAB0DUiR9hGPXBSB2oIIICCQraQSFV1lu2R+kCaV7rFUrvx1b1yeOQDv34/MR6NdjbsjfhPmxSahWaBsvAyx88GRhh0ULgzesEqqkZ19PMV/VzQKBgQDrjkU2sR/pRgGQyx28+9u7GMiLzQkeyZwIrRAvVapN8Rc4gnYH9NmCFzG7mmnldvZsWMilUY9PgbrFwLUl46eGUbeMO9M4b1rrI7Sy+mVO97eH38DfPvkdyntXWXt7gcXQ26G1CUyTDe66JjWt1wXWIuMBk+AlfKShFsuTc+ajMQKBgFNB XbLp3409it3ywWsKXfBjr1zB1onRh3J1cQkrhwMeTpOD0UI7WefviF3fj6ju4jOkEt0ZMjgTf6IHd+AdP8RpSZLjMy+XpM0P5rLQMN/ZOStGJ6gwftNkaKU293Lx0aX3It0np7OBwO0KCsjoeZ30jEse0P75KwRtp+Z8zIsBAoGAN47TexfJtaEK+ZQBoIn0h0mqV1si1QkPfMHSDvriKQ5d5tG8kF0vPVKAQV5kgytBeI+3bEO1iZC8i2FJzL7xeN8ifRCcNXDRXjRdR0oPVIHImQ0XXwTB6JQmzVIFLWgxddDhZKpCQlA8GSRsbqEejtbTjDN0f5sX9llpKxd9xXw= -----END PRIVATE KEY----- ``` 4. Save the converted private key in a new file. 5. Download and extract the latest version of OpenSSL. 6. From the OpenSSL `bin` folder, run one of the following commands: ```text openssl rsa -aes-256-cbc -in "" -out "" -traditional ``` For example: ```text $ openssl rsa -aes-256-cbc -in ConvertedGSuitePK.txt -out rsa.pem -traditional ``` Or: ```text openssl rsa -aes-128-cbc -in "" -out "" -traditional ``` For example: ```text $ openssl rsa -aes-128-cbc -in ConvertedGSuitePK.txt -out rsa.pem -traditional ``` 7. Enter the PEM passphrase. 8. Confirm the passphrase. > [!NOTE] > > Use the generated RSA-format private key and the passphrase as the private key and private key password in the connector configuration. # Integrating with Google Workspace SaaS > [!NOTE] > > Google Workspace is the new name for G Suite. This guide refers to the connector as "Google Workspace" except where "G Suite" is still used, such as in some user interface configurations. > [!IMPORTANT] > > To enable additional cloud governance features, such as visualization of effective access, for your GCP Cloud Infrastructure, you must purchase a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license. Contact your SailPoint Customer Success Manager for more information and to request access. > > Refer to [Supported Features and Prerequisites]() for information on additional features supported with cloud governance. The SailPoint Google Workspace SaaS connector manages accounts, groups, and roles from all available domains of Google Workspace for Business, Education, or ISP when the service account provided in the application configuration has sufficient access to those domains. It also manages Gmail delegates for accounts, moves users between Organizational Units, and manages account and group attributes. The Google Workspace SaaS connector: - Uses the standard exponential backoff strategy recommended by Google to handle errors during aggregation. - Manages Identity and Access Management (IAM) in Google Cloud Platform (GCP). - Manages accounts, groups, and roles for the GCP organization infrastructure, including multiple user types and user access across resources through IAM policies. Google Cloud Platform is a suite of public cloud computing services offered by Google. The platform includes hosted services for compute, storage, and application development that run on Google hardware. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. #### Supported Features Refer to [Supported Features](). #### Prerequisites Refer to [Prerequisites](). #### Administrator Permission Refer to [Administrator Permissions](). # Machine Account Attributes Machine account attributes are used in provisioning configurations for machine accounts. After you have [created the required machine account subtypes](), you can use the machine account attributes to provision machine accounts in your SailPoint tenant. Refer to [Machine Identity Security Overview]() for more information. > [!NOTE] > > Attributes marked with an asterisk (\*) are mandatory. ## Machine Account Provisioning Attributes | Create Machine Account Attribute | Description | | --- | --- | | projectId\* | Google Cloud Project ID where the service account is created. | | serviceAccountId\* | Service account ID (short name) for the machine account. | | displayName\* | Display name of the service account. | | objectType | Object routing type used by the connector; set to `serviceAccount` for the machine-account flow. | | description | Optional description for the service account. | The following GCP configuration is required when you enable SailPoint Non-Human Identity (NHI) Discovery on the Google Workspace SaaS connector. Grant only the roles and APIs that correspond to the features you plan to use. Refer to [Supported Features]() for more information. > [!IMPORTANT] > > SailPoint NHI Discovery requires the Service Account authentication grant type. SailPoint recommends assigning the Viewer and Organization Viewer roles to the SailPoint service account at the organization level. The following table lists additional GCP IAM roles you can assign for least-privilege access by feature: | Feature | GCP IAM Roles | | --- | --- | | Continuous secret discovery | Secret Manager Viewer, Secret Manager Secret Accessor, API Keys Viewer, Cloud Functions Viewer | | IAM monitoring | Cloud Asset Viewer, View Service Accounts, IAM Recommender Viewer, Activity Analysis Viewer, Organization Role Viewer, Folder Viewer | | Compliance validation | Logs Viewer, Logs View Accessor, Private Logs Viewer, Security Reviewer | # Provisioning The Google Workspace SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in Google Workspace directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. The Google Workspace SaaS connector supports all special characters in a password while provisioning. ## Default Create Account Attributes Attributes marked with an asterisk (\*) are required. | Attribute Name | Description | | --- | --- | | objectType | Type of the account to be created. Default value: User. When creating a Domain, the object type must be `domain`. When creating a Service Account, the object type must be `serviceAccount`. | | familyName\* | The user's last name. | | givenName\* | The user's first name. | | password\* | Password for the user account. | | primaryEmail\* | Primary email address of the user. | | domainName | Name of the domain to create. | | projectId | The ID of the project that owns the service account. | | serviceAccountId | Account ID of the service account. | | displayName | Name for the service account. | ## Configuring Complex Provisioning Policy Attributes The Google Workspace SaaS connector supports account provisioning with the following multi-valued complex attributes in JSON format: | Complex Attribute | Example JSON Input | | --- | --- | | emails | `{"address":"test1@google.com","type":"other"}` | | organizations | `{"name":"Sailpoint","title":"SysAdmin", "type":"work", "customType":"","department":"DP Operations","location":"Pune"}` | | phones | `{"value":"9876123345","type":"mobile"}` | | relations | `{"value":"David","type":"brother"}` | | addresses | `{"type":"work","streetAddress":"123 James street","locality":"Domino Park","region":"Lake Side","primary":true,"countryCode":"US"}` | | externalIds | `{"value":"1234","type":"account"}` | | ims | `{"type":"home","protocol":"gtalk","im":"12345","primary":true}` | | locations | `{"area": "Mountain View", "buildingId": "D1", "deskCode": "Desk1", "floorName":"First Floor", "floorSection":"B", "type":"desk"}` | If you need to set multiple values, separate each value in the JSON input with a comma. For example: ```text {"address":"user1@google.com","type":"home"}, {"address":"test1@google.com","type":"other"} ``` The Google Workspace connector supports the `aliases` multi-valued attribute. Aliases are the user's alias email addresses. The values can be a string or a list of email addresses. The connector also supports special characters in email addresses for entitlement operations. > [!NOTE] > > Ensure that complex attributes are multi-valued in the account schema and provisioning policy. Refer to [REST Resource: users]() in the Google Workspace documentation for more information on JSON representation of complex attributes and values. The Google Workspace API does not support adding or removing multiple aliases in a single call, so the connector needs a list of values to iterate over each one. The connector requires a Before Provisioning Rule to create a provisioning plan that ensures the alias values are in list format. The following provisioning plan example adds or removes multiple aliases: ```text { "ProvisioningPlan": { "AccountRequest": { "AttributeRequest": { "Value": { "List": { "String": [ "GoogleWorkspace1222@example.com", "GoogleWorkspace12230@example.com" ] } }, "name": "aliases", "op": "Set" }, "application": "Google workspace", "nativeIdentity": "11234567890", "op": "Modify" }, "nativeIdentity": "Test.google", "targetIntegration": "Google workspace" } } ``` To add or remove a single alias, use the string format: ```text { "AttributeRequest": { "name": "aliases", "op": "Set", "value": "GoogleWorkspace1222@example.com" } } ``` # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Google Workspace SaaS connector uses the following default correlation and object configurations. This connector currently supports the following types of objects: - Account - Account objects are used when building identity Link objects. - Group - Used to build AccountGroup objects that hold entitlements shared across identities. - Role - Used to build Account-Role objects that hold entitlements shared across identities. - IAM Role - Used to represent GCP IAM roles. - IAM Resource Permission - Used to represent GCP permissions over resources. - Folder - Used to represent GCP folders. - Project - Used to represent GCP projects. ## Default Correlation Configuration Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements. You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities]() for more information. When you first create the Google Workspace SaaS source, the default correlation mapping is: | Identity Attribute | Operation | Account Attribute | | --- | --- | --- | | Work Email | Equals | primaryEmail | You can modify the correlation configuration in accordance with your requirements. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | objectID | `Account` | | objectID | `Group` | | objectID | `Role` | | name | `iamRole` | | objectID | `iamresourcePermission` | | objectID | `folder` | | objectID | `project` | ### Default Account Attributes The Google Workspace SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. > [!NOTE] > > To aggregate the Delegated Administrators, add the `delegatedadmins` attribute (supported with Service Account Authorization only) to the account schema manually. | Attribute Name | Description | | --- | --- | | objectID | Unique ID of the user. This is an Account ID which must not be changed. | | primaryEmail | User's primary email ID. The email ID domain must be a valid domain accessible to the service account provided in application configuration. | | name | User's full name. | | isAdmin | Indicates if a user is an administrator. | | isDelegatedAdmin | Indicates if a users is a delegated administrator. | | lastLoginTime | User's last login time. | | suspended | User's suspension status. | | suspensionReason | Reason for suspension. | | changePasswordAtNextLogin | Indicates if the user is required to change their password the next time they log in. | | ipWhiteListed | Indicate if user's IP address is whitelisted. | | ims | The user's Instant Messenger (IM) accounts. | | emails | A list of the user's email addresses. | | externalIds | A list of external IDs for the user, such as an employee or network ID. | | relations | A list of the user's relationships to other users. | | addresses | A list of the user's addresses. | | organizations | A list of organizations the user belongs to. | | phones | A list of the user's phone numbers. | | aliases | A list of the user's alias email addresses. | | nonEditableAliases | A list of the user's non-editable alias email addresses. | | customerId | The customer ID to retrieve all account users. | | orgUnitPath | The full path of the parent organization associated with the user. | | isMailboxSetup | Indicates if the user's Google mailbox is created. | | includeInGlobalAddressList | Indicates if the user's profile is visible in the Global Address List when the contact sharing feature is enabled for the domain. | | thumbnailPhotoUrl | URL used to set the user's thumbnail photo. | | contacts | A list of the user's contacts. | | givenName | User's first name. | | familyName | User's last name. | | delegatedAdmins | Delegated administrators of a user. | | Groups | Groups connected to the user. | | customSchemas | Aggregates custom schema attributes. | | Roles | Roles connected to the user. | | objectType | Object type of the account. | | domainName | The domain name of the customer. | | domainAliases | A list of domain alias. | | isPrimary | Indicates if the domain is a primary domain. | | verified | Indicates the verification state of a domain. | | projectId | The ID of the project that owns the service account. | | uniqueId | The unique and stable numeric ID for the service account. | | displayName | Name for the service account. | | description | Description for the service account. | | serviceAccountId | Account ID of service account. | | resourcePermissions | IAM resource permissions assigned to the user. | | archived | Indicates if a user is archived. Enable to archive the user.

**Important:** If you are updating from a connector created prior to August 25, 2022, you must manually add this attribute to your schema attribute list. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The Google Workspace SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. > [!NOTE] > > To aggregate the `MANAGERS` and `OWNERS` attributes, add them to the group schema manually. | Attribute Name | Description | | --- | --- | | objectID | The group's unique ID. This is an Account ID which must not be changed. | | name | Name of the group. | | nonEditableAliases | List of the group's non-editable alias email addresses that are outside of the account's primary domain or sub domains. These are functioning email addresses used by the group. This is a read-only property. | | description | Description of the group. | | adminCreated | Whether it is created by administrator. | | aliases | Group aliases. | | email | Group email address. | | directMembersCount | Number of group members. | | whoCanJoin | Permissions to join the group. Available values: `ALL_IN_DOMAIN_CAN_JOIN` - Anyone in the account can join; `ANYONE_CAN_JOIN` - Anyone outside your domain can join; `CAN_REQUEST_TO_JOIN` - Non group members can request an invitation to join; `INVITED_CAN_JOIN` - Candidates for membership can be invited to join. | | whoCanViewMembership | Permissions to view membership. Available values: `ALL_IN_DOMAIN_CAN_VIEW` - Anyone in the account can view the group members list; `ALL_MANAGERS_CAN_VIEW` - The group managers can view group members list; `ALL_MEMBERS_CAN_VIEW` - Group members can view the group members list. | | whoCanViewGroup | Permissions to view group. Available values: `ALL_IN_DOMAIN_CAN_VIEW` - Anyone in your account can view this group's messages; `ALL_MANAGERS_CAN_VIEW` - Any group manager can view this group's messages; `ALL_MEMBERS_CAN_VIEW` - All group members can view the group's messages; `ANYONE_CAN_VIEW` - Any Google Workspace user can view the group's messages. | | whoCanInvite | Permissions to invite members. Available values: `ALL_MANAGERS_CAN_INVITE` - Only managers can invite a new member. This includes the group's owner; `ALL_MEMBERS_CAN_INVITE` - Managers and members can invite a new member candidate. | | allowExternalMembers | A Boolean indicating if Google Workspace users external to your account can view or become members of this group. | | MANAGERS | Managers of a group. | | OWNERS | Owners of a group. | | whoCanPostMessage | Permissions to post messages to the group. Available values: `ALL_IN_DOMAIN_CAN_POST` - Anyone in the account can post a message; `ALL_MANAGERS_CAN_POST` - Managers, including group owners, can post messages; `ALL_MEMBERS_CAN_POST` - Any group member can post a message; `ANYONE_CAN_POST` - Any Google Workspace user outside the account can access the Google Groups service and post a message; `NONE_CAN_POST` - The group is disabled and archived. No one can post a message to this group. | | allowWebPosting | A Boolean indicating if any member is allowed to post to the group web forum. | | primaryLanguage | Language tag for a group's primary language. | | maxMessageBytes | The maximum size of a message. | | isArchived | A Boolean indicating if the contents of the group to be archived. | | archiveOnly | A Boolean indicating if the group is to be only archived. | | messageModerationLevel | Moderation level for messages. Available values: `MODERATE_ALL_MESSAGES` - All messages are approved by the owner before they are sent to the group; `MODERATE_NEW_MEMBERS` - All messages from new members are approved by the owner before they are sent to the group; `MODERATE_NONE` - No moderator approval is required; `MODERATE_NON_MEMBERS` - All messages from non-group members are approved by the owner before they are sent to the group. | | spamModerationLevel | Moderation levels for detecting messages as spam. Available values: `ALLOW` - Post the message to the group; `MODERATE` - Send the message to the moderation queue; `SILENTLY_MODERATE` - Send the message to the moderation queue, but do not send notification to moderators; `REJECT` - Immediately reject the message. | | replyTo | The default reply to a message is sent here. Available values: `REPLY_TO_CUSTOM` - For replies to messages, use the group's custom email address; `REPLY_TO_IGNORE` - Group users individually decide where the message reply is sent; `REPLY_TO_LIST` - Reply message is sent to the group; `REPLY_TO_MANAGERS` - Reply message is sent to the group's managers; `REPLY_TO_OWNER` - Reply is sent to the owner(s) of the group; `REPLY_TO_SENDER` - Reply is sent to the author of message. | | customReplyTo | An email address used when replying to a message. | | sendMessageDenyNotification | A Boolean indicating if the members are notified if a message is denied by owner. | | defaultMessageDenyNotificationText | Text sent to the message's author as part of rejection notification. | | showInGroupDirectory | A Boolean indicating if group is listed in the Groups directory. | | allowGoogleCommunication | A Boolean allowing Google to contact group administrators. | | membersCanPostAsTheGroup | A Boolean indicating if members can post using the group email address. | | messageDisplayFont | Default message's display font. Available values: `DEFAULT_FONT` - Uses the account's default font; `FIXED_WIDTH_FONT` - Uses fixed width font. | | includeInGlobalAddressList | A Boolean indicating if the group is included in the [Global Address List](). | | resourcePermissions | IAM resource permissions assigned to the group. | ### Default Role Attributes The Google Workspace SaaS connector supports roles. The following attributes must be configured on the managed system and in the SailPoint source schema to manage roles. | Attribute Name | Description | | --- | --- | | objectID | The role's unique ID. This is an Account ID which must not be changed. | | roleName | Name of the role. | | roleDescription | Description of the role. | | rolePrivileges | Privileges of the role, a multivalued attribute. Available values: `GROUPS_ALL`; `APP_ADMIN`. | | isSystemRole | Indicates if the role is a system role. | | isSuperAdminRole | Indicates if the role is a Super Admin role. | ### IAM Role Attributes The following lists the IAM role attributes: | Attribute Name | Description | | --- | --- | | name | Name of the IAM role. This is an Account ID which must not be changed. | | description | A description for the IAM role. | | title | A title for the role. | | includedPermissions | The names of the permissions this IAM role grants when bound in an IAM policy. | | stage | The current launch stage of the IAM role. | | deleted | The current deleted state of the IAM role. | ### GCP Vertex Agent Attributes The following table lists the GCP Vertex agent attributes: | Parent Attribute Name | Child Attribute Name | Description | | --- | --- | --- | | identity | | Unique identifier for the agent. | | name | | Name assigned to the agent. | | datasetId | | Internal SailPoint dataset for the agent. | | description | | Descriptive text explaining the agent's purpose. | | attributes | projectId | The ID of the project under which the agent resides. | | | locationId | The GCP region in which the agent resides. | | | createTime | The timestamp when the agent was created. | | | updateTime | The timestamp when the agent was last updated. | ### IAM Resource Permission Attributes The following lists the IAM resource permission attributes: | Attribute Name | Description | | --- | --- | | objectID | ID of the resource permission. This is an Account ID which must not be changed. | | displayName | Display name of the resource permission. This is a combination of the role display name and the resource display name. | | description | Description of the role associated with the resource permission. | | includedPermissions | Permissions over the resource included in the role. | | stage | Stage of the role associated with the resource permission. | | resourceName | Resource name associated with the resource permission. | | roleName | Role name associated with the resource permission. | | resourceType | Type of resource associated with the resource permission. | ### Default Folder Attributes The following lists the folder attributes: | Attribute Name | Description | | --- | --- | | objectID | ID of the folder in the format `folders/{numeric folder ID}`. This is an Account ID which must not be changed. | | name | The full resource name of the folder. | | assetType | Asset type of the GCP resource. | | displayName | Display name of the folder. | | location | Location of the folder. | | state | State of the folder. | ### Project Attributes The following lists the project attributes: | Attribute Name | Description | | --- | --- | | objectID | ID of the project in the format `projects/{alpha numeric project ID}`. This is an Account ID which must not be changed. | | name | The full resource name of the project. | | assetType | Asset type of the GCP resource. | | displayName | Display name of the project. | | labels | Labels used by the project. This attribute is multi-valued and must be manually added to the project schema in existing sources. | | location | Location of the project. | | state | State of the project. | | tags | Tags used by the project. This attribute is multi-valued and must be manually added to the project schema in existing sources. | ## Custom Schema Attributes The Google Workspace SaaS connector supports aggregation of custom schema attributes by adding the schema attributes in the following format: ```text customSchemas.SCHEMANAME.FIELDNAME ``` For example, if the custom schemas are as follows: ```text customSchemas = {SSO {"ADID":"101", "SAPID":"102"}, Address {"Postal_Code":"411018"}} ``` To display the attributes of the above custom schemas, you must add the following attributes in account schema: ```text customSchemas.SSO.ADID customSchemas.SSO.SAPID customSchemas.Address.Postal_Code ``` > [!NOTE] > > A schema cannot contain another schema within a managed system as follows: > > ```text > customSchemas= {SSO{Address{"Postal_Code":"411018"}}} > ``` > > The connector does not support managing multi-level custom attributes defined in Google Workspace. Multi-level custom attributes are used if you have a schema defined inside a custom schema. The name of the custom schema attribute must be the same as defined in the account schema. To add a custom schema attribute to the provisioning policy, it must also be present in the account schema. To support custom attribute provisioning, add the custom attribute names to the provisioning policy as described below: ```text customSchemas.. ``` For more information on adding an attribute to schema, refer to [Adding Attributes to a Source Schema](). For the Custom Schema attributes the Google Workspace source supports single valued and multi-valued attribute only. Provisioning of multilevel custom schema attributes is not supported. # Supported Features and Prerequisites ## Supported Features The SailPoint Google Workspace SaaS connector supports the following features: > [!IMPORTANT] > > You must purchase a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license to enable Google Cloud Platform (GCP) features. Contact your SailPoint Customer Success Manager for more information and to request access. > [!NOTE] > > Before you can use an item marked with an asterisk (\*), SailPoint must activate the feature for your site. - Aggregation of Google Workspace accounts (user, service account, domain) - \*Provisioning of Google Workspace accounts (user, service account, domain) - \*Access Certifications (certification of entitlements connected to accounts) - Delta Aggregation - Filtering of user records during full and delta aggregation. Refer to [Advanced Settings]() for more information. ### Non-Human Identity Discovery > [!IMPORTANT] > > Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. Refer to [SailPoint Agentic Fabric]() for more information. - SailPoint Non-Human Identity Discovery for Google API keys, Google Cloud service account credentials, and GCP Workload Identity Federation bindings. - Aggregation of Google Cloud Platform (GCP) Vertex AI agents. - Aggregation of Google Cloud Agent Registry agents, including Vertex AI agents, Gemini Enterprise agents, and manually registered agents. - Aggregation of Workload and Workforce Identity Federated Principals. - Continuous secret discovery, IAM monitoring, and compliance validation for Google Cloud credentials. - Agent Discovery supports the Service Account grant type only. Refer to [Additional Permissions for SailPoint Non-Human Identity (NHI) Discovery]() for more information. Refer to Dataset Management for more information. Refer to [Discovering Potential Non-Human Accounts]() for more information. ### Multiple Account Type Support The following table details the supported feature set for each account type: | Feature | Google Workspace User/Cloud Identity | Service Account | Domain | | --- | --- | --- | --- | | Aggregate | Yes | Yes | Yes | | Create | Yes | Yes | Yes | | Password Management | Yes | N/A | N/A | | Enable and Disable | Yes | Yes | N/A | | Group Entitlements (Read, Request, and Revoke) | Groups, roles, and resource permission | Resource permission | Resource permission | ### Group Entitlements SailPoint is capable of aggregating additional details of Group Entitlements from the managed system. These objects have a separate schema which defines a list of attributes. Aggregation tasks fetch the defined attributes as additional details when it runs aggregation processes for a specific Group Entitlement type. Supported Google Workspace objects include: - Groups - Roles > [!NOTE] > > Only Group, Role, and Resource Permissions can be requested as multiple group entitlements. Supported GCP objects include: - IAM Roles - Projects - Folders - Resource Permissions Google Workspace Groups are both accounts and entitlements in GCP support. GCP entitlement resource permissions can be assigned to Google Workspace Groups. #### Support for Managing Google Cloud Objects The Google Workspace SaaS connector can manage the following Google Cloud objects: - Google Accounts (Google Workspace Identities and managed Cloud Identities only) - Service Accounts - Domains (Google Workspace or Cloud Identity Domain) - Google Groups #### Supported Authentication Methods The Google Workspace SaaS connector supports the following authentication and authorization methods: - Client Credentials (OAuth 2.0 for Web Server Applications) - Service Account (OAuth 2.0 for Server to Server Applications) #### Support for Multiple Group Objects The Google Workspace SaaS connector supports multiple group objects. Entitlement aggregation is supported for the following: - Groups - Roles - IAM Roles - Projects - Folders - Resource Permissions ### Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). ### Activity Insights Activity Insights supports activity from Google Workspace and its associated accounts. This allows you to gather account information and activity data from Google Workspace. > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. Refer to [Activity Insights Settings]() for information on configuring Activity Insights. ### Supported Features Comparison with Cloud Governance > [!IMPORTANT] > > To enable additional cloud governance features (for example, visualization of effective access) for your GCP Cloud Infrastructure, you must have a CIEM license. If you already have a Cloud Access Management license, no additional license purchase is required. Contact your SailPoint Customer Success Manager to request access and for more information. | Supported Features | Google Workspace Connector (Standard Features) | Google Workspace Connector (with Cloud Governance) | | --- | --- | --- | | Account Management:
Manage Google Workspace Users as Accounts
Aggregate, Refresh Accounts, Aggregate and Provision Custom Schema Attributes
Create, Update, Delete
Enable, Disable, and Change Password
Add and Remove Entitlements
Manages Delegated Administrators and Alias on Accounts
Move User to Other Organization Unit | Yes | Yes | | GCP Accounts:
Service Account
Domain (Google Workspace or Cloud Identity Domain) | No | Yes | | Group Management:
Manage Google Workspace Groups as Account - Groups
Aggregate and Refresh Group | Yes | Yes | | Role Management:
Manage Google Workspace Roles as Account - Roles
Aggregate and Refresh Roles | Yes | Yes | | IAM Role Management:
Manage GCP IAM Roles as IAMRole
Aggregate and Refresh Role | No | Yes | | Project Management:
Manage GCP Project as Project
Aggregate and Refresh
Manages Delegated Administrators (Supported with Service Account Authorization Only) and Alias on Accounts | No | Yes | | Folder Management:
Manage GCP Folder as Folder
Aggregate and Refresh | No | Yes | | IAM Resource Permission Management:
Manage GCP Resource Permission as iamResourcePermission
Aggregate and Refresh | No | Yes | ### Password Management If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for an application connected to this source, the change will automatically be made to the source itself. For more information on configuring password management, refer to [Password Management Overview](). ## Prerequisites - A working instance of Google Workspace. ### OAuth 2.0 Authentication Methods The Google Workspace SaaS connector uses the OAuth 2.0 protocol for API authentication and authorization, supporting the following two scenarios: - Client Credentials (OAuth 2.0 for Web Server Applications) - Service Account (OAuth 2.0 for Server to Server Applications) > **Note** > > SailPoint's Cloud Infrastructure Entitlement Management (CIEM) only supports Service Account as a grant type. Refer to [Service Account Authentication Settings]() for more information. #### API Access Permissions via Roles API access permissions are assigned to the Google Workspace user via roles, based on the type of credentials used: - Client Credentials - API access is performed on behalf of the Google Workspace user under whose context the credentials are generated. This user provides consent while generating the refresh token. Refer to [Required Roles for Google Workspace and GCP Management](<#required-roles-for-google-workspace-and-gcp-management>) for more information. - Service Account - API access is performed on behalf of an impersonating user. The roles assigned to the impersonating user take priority over the roles assigned directly to the Service Account. Refer to [Required Roles for Google Workspace and GCP Management](<#required-roles-for-google-workspace-and-gcp-management>) for more information. Refer to [Generating OAuth 2.0 Credentials]() for information on generating Client Credentials and a Service Account. ### SailPoint Non-Human Identity (NHI) Discovery To enable continuous secret discovery, IAM monitoring, compliance validation, and SailPoint NHI Discovery datasets on the Google Workspace SaaS connector, complete the GCP service account, IAM role, API enablement, and optional audit log configuration. SailPoint NHI Discovery requires the Service Account authentication grant type. > [!NOTE] > > Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. Refer to [SailPoint Agentic Fabric]() for more information. ### CIEM and Google Cloud Platform (GCP) Setup > [!NOTE] > > To enable advanced cloud governance features, such as the visualization of effective access for your GCP Cloud Infrastructure, a SailPoint CIEM license is required. Contact your SailPoint Customer Success Manager for access and further details. Before generating OAuth 2.0 credentials for a service account, ensure the following Google Cloud Platform (GCP) configurations are in place: 1. Verify that a GCP Organization is available. 2. Create a project at the Organization level within the Google Cloud Platform Console. This requires a user with Super Admin or Project Creator privileges. 3. In the newly created or existing project, go to [APIs & Services \> Library]() and enable the following APIs: - Admin SDK API - Groups Settings API - Identity and Access Management (IAM) API - Cloud Resource Manager API - Cloud Asset API (required for SailPoint NHI Discovery) - API Keys API (required for SailPoint NHI Discovery) - Recommender API (required for SailPoint NHI Discovery) - Cloud Logging API (required for SailPoint NHI Discovery) - Agent Registry API (required for Agent Registry aggregation) > **Note** > > Enable Secret Manager API, Cloud Functions API, Admin SDK API, and Google Drive API when you use the corresponding SailPoint NHI Discovery capabilities. 4. Create a service account in GCP under the project. Refer to [Creating a Service Account and Generating a Private Key](). 5. Create a custom role for the service account at the Organization level and assign the permissions. Refer to [Creating Custom Roles](). 6. Grant the service account access. Refer to [Adding Scopes to the Service Account](). 7. Create an admin account in Google Workspace and configure its permissions in Google Cloud Platform (GCP). 8. Go to the service account's **Keys** page, select **Add key \> Create new key**, and then select **JSON** as the key type. Refer to [Converting a Service Account Private Key to RSA Format](). ### Required Roles for Google Workspace and GCP Management The required roles for Google Workspace User, Group, and Role management are: - For Google Workspace User and Groups Management - User Management Admin Role and Group Admin Role. - For Google Workspace Roles Management - Super Admin Role. The required GCP IAM roles for GCP management are: - Cloud Asset Viewer - Organization Role Administrator - Organization Role Viewer - Service Account Admin - Folder IAM Admin - Organization Administrator - Project IAM Admin - Agent Registry Viewer (required for Agent Registry aggregation) - Super Admin Role (for IAM Role Management and Domain Management) - Viewer (required for SailPoint NHI Discovery at organization scope) - Organization Viewer (required for SailPoint NHI Discovery at organization scope) The necessary granular permissions for the user can be assigned through Service Account Scopes and Built-In Roles for an Impersonated User, or Service Account Scopes and Custom Roles for an Impersonated User. #### Google Reference Documents > [!NOTE] > > The documents listed in this section are not managed by SailPoint and are subject to change without notice. Refer to the following resources for more information about the prerequisites: - [GCP Organization]() - [Admin SDK API]() - [Groups Settings API]() - [Identity and Access Management (IAM) API]() - [Cloud Resource Manager API]() - [Cloud Asset API]() - [Agent Registry roles and permissions]() # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## Account Aggregation Fails **Issue**: The account aggregation may fail due to insufficient permissions or if required services are not turned on. **Resolution**: To test a GET user (read) using an Admin SDK Directory API from a browser, use the following URL, but replace `` and `` values: ```text https://www.googleapis.com/admin/directory/v1/users/?access_token= ``` ## Entitlement Aggregation Fails **Issue**: The entitlement aggregation fails due to insufficient permissions or if required services are not turned on. **Resolution**: To test a GET group (read) using an Admin SDK Directory API from a browser, use the following URL, but replace the `` and `` values: ```text https://www.googleapis.com/admin/directory/v1/groups/?access_token= ``` To test a GET group (read) using the Google Groups Settings API (Read Group Details - Y) from a browser, use the following URL but replace the `` and `` values: ```text https://www.googleapis.com/groups/v1/groups/?access_token= ``` ## Internal Server and Service Unavailable Error **Issue**: The Internal Server and Service Unavailable error messages are sent by the Google Server. **Resolution**: To retry the request, use the `maxReadRetryCount` attribute. The retry count is set to 5 by default. Retry is performed using the standard Exponential Backoff strategy. Increase the retry count by adding the `maxReadRetryCount` attribute with the REST API: - **key** - `connector_maxReadRetryCount` - **value** - enter the number of retry options, for example, 10 ## Poor Aggregation Performance **Resolution**: For the Google Workspace source, the performance of account aggregation and entitlement aggregation can be improved by deleting the following schema attributes: - `delegatedAdmins` - `MANAGERS` - `OWNERS` The `MANAGERS` and `OWNERS` attributes must be deleted in combination. Deleting the `MANAGERS` or `OWNERS` attribute alone does not improve performance. ## Entitlements Do Not Display Friendly Names **Issue**: During the initial account aggregation, any entitlement associated with the accounts is aggregated as a unique identifier. **Resolution**: Configure and perform an entitlement aggregation to bring in the friendly entitlement names. ## The Create Account Operation Fails Because of a Time Delay to Provide Account Details Through the APIs **Issue**: The following errors are encountered: ```text error code 412 "User creation is not complete" error code 404 "Object not found" ``` **Resolution**: Add the `createAccountTimelag` attribute in the connector. This attribute introduces a delay (default 0 seconds) after the Account Create operation so that subsequent operations such as assigning groups, aliases, and GET Object will not encounter errors. Add the `createAccountTimelag` attribute with a value of 20 seconds using the REST APIs. Refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)](). ## 403 Error - Not Authorized to Access This Resource/API During Create Account Operation **Resolution**: Ensure that the domain name of the primary email of the user being created contains the correct domain name across which a set of credentials are created. Also ensure the domain name is configured the same as the domain in the application configuration. ## Account Aggregation Fails With an Object Not Found Error Message **Issue**: Account aggregation fails with the following error message: ```text ObjectNotFoundException ] [ Error details ] Service Account iteration failed. Error: 404 null : Requested entity was not found. ``` **Resolution**: By adding the `serviceAccountAggWithAssetInventory` attribute to the source, API calls to aggregate service accounts are executed through the Asset Inventory API instead of the service account List API (which, by default, also tries to fetch service accounts from deleted projects/folders). The downside is that the service account description and disabled attributes are not provided by the Asset Inventory API. Add the following using the REST APIs: ```text curl --location --request PATCH 'https://.api.cloud.sailpoint.com/v3/sources/{source ID}' \ --header 'Content-Type: application/json-patch+json' \ --header 'Authorization: Bearer tokenValue' \ --data-raw '[ { "op": "add", "path": "/connectorAttributes/serviceAccountAggWithAssetInventory", "value": true } ]' ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Google Cloud Asset Aggregation Fails With "Permission Denied" (403) **Issue**: Account aggregation fails with the error: ```text Failed to preload IAM Policy, Error: 403 null: The caller does not have permission. ``` This error typically occurs when the connector attempts to call the `searchAllIamPolicies` API, specifically when querying for domain resources. The API endpoint referenced in error: ```text https://cloudasset.googleapis.com/v1/organizations/672370982061:searchAllIamPolicies?query=resource:(cloudresourcemanager OR iam) AND policy:("user:" OR "serviceAccount:" OR "domain:") ``` By default, the connector attempts to retrieve cloud resources for service accounts, users, and domains. Aggregating domain resources requires additional Google Cloud scopes and permissions that may not be configured. **Resolution**: If domain management or aggregation is not necessary for your use case, you can disable domain aggregation to resolve the permission error. To do this, add the `gcpAccountTypes` attribute to your source configuration via the REST API. For example: ```text [ { "op": "add", "path": "/connectorAttributes/gcpAccountTypes", "value": ["serviceAccount", "user"] } ] ``` > [!NOTE] > > If domain aggregation is required, ensure that the necessary additional scopes and permissions are granted to the connector's service account or identity. Refer to [Service Account Scopes and Built-In Roles for an Impersonated User]() for the specific permissions needed to aggregate domain resources.