Supported Features and Prerequisites

Supported Features

The SailPoint Google Workspace SaaS connector supports the following features:

• Aggregation of Google Workspace accounts (user, service account, domain)
• *Provisioning of Google Workspace accounts (user, service account, domain)
• *Access Certifications (certification of entitlements connected to accounts)

• Delta Aggregation

• Filtering of user records during full and delta aggregation. Refer to Advanced Settings for more information.

Non-Human Identity Discovery

• SailPoint Non-Human Identity Discovery for Google API keys, Google Cloud service account credentials, and GCP Workload Identity Federation bindings.
• Aggregation of Google Cloud Platform (GCP) Vertex AI agents.
• Aggregation of Google Cloud Agent Registry agents, including Vertex AI agents, Gemini Enterprise agents, and manually registered agents.
• Aggregation of Workload and Workforce Identity Federated Principals.
• Continuous secret discovery, IAM monitoring, and compliance validation for Google Cloud credentials.
• Agent Discovery supports the Service Account grant type only.

Refer to Additional Permissions for SailPoint Non-Human Identity (NHI) Discovery for more information.

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Multiple Account Type Support

The following table details the supported feature set for each account type:

Group Entitlements

SailPoint is capable of aggregating additional details of Group Entitlements from the managed system. These objects have a separate schema which defines a list of attributes. Aggregation tasks fetch the defined attributes as additional details when it runs aggregation processes for a specific Group Entitlement type.

Supported Google Workspace objects include:

• Groups
• Roles

Supported GCP objects include:

• IAM Roles
• Projects
• Folders
• Resource Permissions

Google Workspace Groups are both accounts and entitlements in GCP support. GCP entitlement resource permissions can be assigned to Google Workspace Groups.

Support for Managing Google Cloud Objects

The Google Workspace SaaS connector can manage the following Google Cloud objects:

• Google Accounts (Google Workspace Identities and managed Cloud Identities only)
• Service Accounts
• Domains (Google Workspace or Cloud Identity Domain)
• Google Groups

Supported Authentication Methods

The Google Workspace SaaS connector supports the following authentication and authorization methods:

• Client Credentials (OAuth 2.0 for Web Server Applications)
• Service Account (OAuth 2.0 for Server to Server Applications)

Support for Multiple Group Objects

The Google Workspace SaaS connector supports multiple group objects. Entitlement aggregation is supported for the following:

• Groups
• Roles
• IAM Roles
• Projects
• Folders
• Resource Permissions

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

For more information, refer to Managing Privilege Classification.

Activity Insights

Activity Insights supports activity from Google Workspace and its associated accounts. This allows you to gather account information and activity data from Google Workspace.

Supported Features Comparison with Cloud Governance

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Prerequisites

• A working instance of Google Workspace.

OAuth 2.0 Authentication Methods

The Google Workspace SaaS connector uses the OAuth 2.0 protocol for API authentication and authorization, supporting the following two scenarios:

• Client Credentials (OAuth 2.0 for Web Server Applications)

• Service Account (OAuth 2.0 for Server to Server Applications)

  Note

  SailPoint's Cloud Infrastructure Entitlement Management (CIEM) only supports Service Account as a grant type. Refer to Service Account Authentication Settings for more information.

API Access Permissions via Roles

API access permissions are assigned to the Google Workspace user via roles, based on the type of credentials used:

• Client Credentials - API access is performed on behalf of the Google Workspace user under whose context the credentials are generated. This user provides consent while generating the refresh token. Refer to Required Roles for Google Workspace and GCP Management for more information.
• Service Account - API access is performed on behalf of an impersonating user. The roles assigned to the impersonating user take priority over the roles assigned directly to the Service Account. Refer to Required Roles for Google Workspace and GCP Management for more information.

Refer to Generating OAuth 2.0 Credentials for information on generating Client Credentials and a Service Account.

SailPoint Non-Human Identity (NHI) Discovery

To enable continuous secret discovery, IAM monitoring, compliance validation, and SailPoint NHI Discovery datasets on the Google Workspace SaaS connector, complete the GCP service account, IAM role, API enablement, and optional audit log configuration. SailPoint NHI Discovery requires the Service Account authentication grant type.

CIEM and Google Cloud Platform (GCP) Setup

Before generating OAuth 2.0 credentials for a service account, ensure the following Google Cloud Platform (GCP) configurations are in place:

1. Verify that a GCP Organization is available.
2. Create a project at the Organization level within the Google Cloud Platform Console. This requires a user with Super Admin or Project Creator privileges.

3. In the newly created or existing project, go to APIs & Services > Library and enable the following APIs:

   • Admin SDK API
   • Groups Settings API
   • Identity and Access Management (IAM) API
   • Cloud Resource Manager API
   • Cloud Asset API (required for SailPoint NHI Discovery)
   • API Keys API (required for SailPoint NHI Discovery)
   • Recommender API (required for SailPoint NHI Discovery)
   • Cloud Logging API (required for SailPoint NHI Discovery)
   • Agent Registry API (required for Agent Registry aggregation)

   Note

   Enable Secret Manager API, Cloud Functions API, Admin SDK API, and Google Drive API when you use the corresponding SailPoint NHI Discovery capabilities.

4. Create a service account in GCP under the project. Refer to Creating a Service Account and Generating a Private Key.

5. Create a custom role for the service account at the Organization level and assign the permissions. Refer to Creating Custom Roles.
6. Grant the service account access. Refer to Adding Scopes to the Service Account.
7. Create an admin account in Google Workspace and configure its permissions in Google Cloud Platform (GCP).
8. Go to the service account's Keys page, select Add key > Create new key, and then select JSON as the key type. Refer to Converting a Service Account Private Key to RSA Format.

Required Roles for Google Workspace and GCP Management

The required roles for Google Workspace User, Group, and Role management are:

• For Google Workspace User and Groups Management - User Management Admin Role and Group Admin Role.
• For Google Workspace Roles Management - Super Admin Role.

The required GCP IAM roles for GCP management are:

• Cloud Asset Viewer

• Organization Role Administrator

• Organization Role Viewer

• Service Account Admin
• Folder IAM Admin
• Organization Administrator

• Project IAM Admin

• Agent Registry Viewer (required for Agent Registry aggregation)

• Super Admin Role (for IAM Role Management and Domain Management)

• Viewer (required for SailPoint NHI Discovery at organization scope)

• Organization Viewer (required for SailPoint NHI Discovery at organization scope)

The necessary granular permissions for the user can be assigned through Service Account Scopes and Built-In Roles for an Impersonated User, or Service Account Scopes and Custom Roles for an Impersonated User.

Google Reference Documents

Refer to the following resources for more information about the prerequisites:

• GCP Organization
• Admin SDK API
• Groups Settings API
• Identity and Access Management (IAM) API
• Cloud Resource Manager API

• Cloud Asset API

• Agent Registry roles and permissions

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.