# Supported Features and Prerequisites

## Supported Features

The SailPoint Google Workspace SaaS connector supports the following features:

> [!IMPORTANT]
>
> You must purchase a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license to enable Google Cloud Platform (GCP) features. Contact your SailPoint Customer Success Manager for more information and to request access.

> [!NOTE]
>
> Before you can use an item marked with an asterisk (\*), SailPoint must activate the feature for your site.

- Aggregation of Google Workspace accounts (user, service account, domain)
- \*Provisioning of Google Workspace accounts (user, service account, domain)
- \*Access Certifications (certification of entitlements connected to accounts)
- Delta Aggregation
- Filtering of user records during full and delta aggregation. Refer to [Advanced Settings](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/additional_configurations.html#advanced-settings>) for more information.

### Non-Human Identity Discovery

> [!IMPORTANT]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. Refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

- SailPoint Non-Human Identity Discovery for Google API keys, Google Cloud service account credentials, and GCP Workload Identity Federation bindings.
- Aggregation of Google Cloud Platform (GCP) Vertex AI agents.
- Aggregation of Google Cloud Agent Registry agents, including Vertex AI agents, Gemini Enterprise agents, and manually registered agents.
- Aggregation of Workload and Workforce Identity Federated Principals.
- Continuous secret discovery, IAM monitoring, and compliance validation for Google Cloud credentials.
- Agent Discovery supports the Service Account grant type only.

Refer to [Additional Permissions for SailPoint Non-Human Identity (NHI) Discovery](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/nhi_permissions.html>) for more information.

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

### Multiple Account Type Support

The following table details the supported feature set for each account type:

| Feature | Google Workspace User/Cloud Identity | Service Account | Domain |
| --- | --- | --- | --- |
| Aggregate | Yes | Yes | Yes |
| Create | Yes | Yes | Yes |
| Password Management | Yes | N/A | N/A |
| Enable and Disable | Yes | Yes | N/A |
| Group Entitlements (Read, Request, and Revoke) | Groups, roles, and resource permission | Resource permission | Resource permission |

### Group Entitlements

SailPoint is capable of aggregating additional details of Group Entitlements from the managed system. These objects have a separate schema which defines a list of attributes. Aggregation tasks fetch the defined attributes as additional details when it runs aggregation processes for a specific Group Entitlement type.

Supported Google Workspace objects include:

- Groups
- Roles

> [!NOTE]
>
> Only Group, Role, and Resource Permissions can be requested as multiple group entitlements.

Supported GCP objects include:

- IAM Roles
- Projects
- Folders
- Resource Permissions

Google Workspace Groups are both accounts and entitlements in GCP support. GCP entitlement resource permissions can be assigned to Google Workspace Groups.

#### Support for Managing Google Cloud Objects

The Google Workspace SaaS connector can manage the following Google Cloud objects:

- Google Accounts (Google Workspace Identities and managed Cloud Identities only)
- Service Accounts
- Domains (Google Workspace or Cloud Identity Domain)
- Google Groups

#### Supported Authentication Methods

The Google Workspace SaaS connector supports the following authentication and authorization methods:

- Client Credentials (OAuth 2.0 for Web Server Applications)
- Service Account (OAuth 2.0 for Server to Server Applications)

#### Support for Multiple Group Objects

The Google Workspace SaaS connector supports multiple group objects. Entitlement aggregation is supported for the following:

- Groups
- Roles
- IAM Roles
- Projects
- Folders
- Resource Permissions

### Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

### Activity Insights

Activity Insights supports activity from Google Workspace and its associated accounts. This allows you to gather account information and activity data from Google Workspace.

> [!IMPORTANT]
>
> Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. Refer to [Activity Insights Settings](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/additional_configurations.html#activity-insights-settings>) for information on configuring Activity Insights.

### Supported Features Comparison with Cloud Governance

> [!IMPORTANT]
>
> To enable additional cloud governance features (for example, visualization of effective access) for your GCP Cloud Infrastructure, you must have a CIEM license. If you already have a Cloud Access Management license, no additional license purchase is required. Contact your SailPoint Customer Success Manager to request access and for more information.

| Supported Features | Google Workspace Connector (Standard Features) | Google Workspace Connector (with Cloud Governance) |
| --- | --- | --- |
| Account Management:<br>Manage Google Workspace Users as Accounts<br>Aggregate, Refresh Accounts, Aggregate and Provision Custom Schema Attributes<br>Create, Update, Delete<br>Enable, Disable, and Change Password<br>Add and Remove Entitlements<br>Manages Delegated Administrators and Alias on Accounts<br>Move User to Other Organization Unit | Yes | Yes |
| GCP Accounts:<br>Service Account<br>Domain (Google Workspace or Cloud Identity Domain) | No | Yes |
| Group Management:<br>Manage Google Workspace Groups as Account - Groups<br>Aggregate and Refresh Group | Yes | Yes |
| Role Management:<br>Manage Google Workspace Roles as Account - Roles<br>Aggregate and Refresh Roles | Yes | Yes |
| IAM Role Management:<br>Manage GCP IAM Roles as IAMRole<br>Aggregate and Refresh Role | No | Yes |
| Project Management:<br>Manage GCP Project as Project<br>Aggregate and Refresh<br>Manages Delegated Administrators (Supported with Service Account Authorization Only) and Alias on Accounts | No | Yes |
| Folder Management:<br>Manage GCP Folder as Folder<br>Aggregate and Refresh | No | Yes |
| IAM Resource Permission Management:<br>Manage GCP Resource Permission as iamResourcePermission<br>Aggregate and Refresh | No | Yes |

### Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Prerequisites

- A working instance of Google Workspace.

### OAuth 2.0 Authentication Methods

The Google Workspace SaaS connector uses the OAuth 2.0 protocol for API authentication and authorization, supporting the following two scenarios:

- Client Credentials (OAuth 2.0 for Web Server Applications)
- Service Account (OAuth 2.0 for Server to Server Applications)

  > **Note**
  >
  > SailPoint's Cloud Infrastructure Entitlement Management (CIEM) only supports Service Account as a grant type. Refer to [Service Account Authentication Settings](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/connecting.html#service-account-authentication-settings>) for more information.

#### API Access Permissions via Roles

API access permissions are assigned to the Google Workspace user via roles, based on the type of credentials used:

- Client Credentials - API access is performed on behalf of the Google Workspace user under whose context the credentials are generated. This user provides consent while generating the refresh token. Refer to [Required Roles for Google Workspace and GCP Management](<#required-roles-for-google-workspace-and-gcp-management>) for more information.
- Service Account - API access is performed on behalf of an impersonating user. The roles assigned to the impersonating user take priority over the roles assigned directly to the Service Account. Refer to [Required Roles for Google Workspace and GCP Management](<#required-roles-for-google-workspace-and-gcp-management>) for more information.

Refer to [Generating OAuth 2.0 Credentials](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/generating_oauth_2_0_credentials.html>) for information on generating Client Credentials and a Service Account.

### SailPoint Non-Human Identity (NHI) Discovery

To enable continuous secret discovery, IAM monitoring, compliance validation, and SailPoint NHI Discovery datasets on the Google Workspace SaaS connector, complete the GCP service account, IAM role, API enablement, and optional audit log configuration. SailPoint NHI Discovery requires the Service Account authentication grant type.

> [!NOTE]
>
> Your organization must have SailPoint Agentic Fabric to use this feature. Contact your Customer Success team for more information. Refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

### CIEM and Google Cloud Platform (GCP) Setup

> [!NOTE]
>
> To enable advanced cloud governance features, such as the visualization of effective access for your GCP Cloud Infrastructure, a SailPoint CIEM license is required. Contact your SailPoint Customer Success Manager for access and further details.

Before generating OAuth 2.0 credentials for a service account, ensure the following Google Cloud Platform (GCP) configurations are in place:

1. Verify that a GCP Organization is available.
2. Create a project at the Organization level within the Google Cloud Platform Console. This requires a user with Super Admin or Project Creator privileges.
3. In the newly created or existing project, go to [APIs &amp; Services \> Library](<https://console.cloud.google.com/apis/library>) and enable the following APIs:

   - Admin SDK API
   - Groups Settings API
   - Identity and Access Management (IAM) API
   - Cloud Resource Manager API
   - Cloud Asset API (required for SailPoint NHI Discovery)
   - API Keys API (required for SailPoint NHI Discovery)
   - Recommender API (required for SailPoint NHI Discovery)
   - Cloud Logging API (required for SailPoint NHI Discovery)
   - Agent Registry API (required for Agent Registry aggregation)

   > **Note**
   >
   > Enable Secret Manager API, Cloud Functions API, Admin SDK API, and Google Drive API when you use the corresponding SailPoint NHI Discovery capabilities.
4. Create a service account in GCP under the project. Refer to [Creating a Service Account and Generating a Private Key](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/generating_oauth_2_0_credentials.html#creating-a-service-account-and-generating-a-private-key>).
5. Create a custom role for the service account at the Organization level and assign the permissions. Refer to [Creating Custom Roles](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/custom_role_permissions.html#creating-custom-roles>).
6. Grant the service account access. Refer to [Adding Scopes to the Service Account](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/generating_oauth_2_0_credentials.html#adding-scopes-to-the-service-account>).
7. Create an admin account in Google Workspace and configure its permissions in Google Cloud Platform (GCP).
8. Go to the service account's **Keys** page, select **Add key \> Create new key**, and then select **JSON** as the key type. Refer to [Converting a Service Account Private Key to RSA Format](<https://documentation.sailpoint.com/connectors/google_workspace/saas/help/generating_oauth_2_0_credentials.html#converting-a-service-account-private-key-to-rsa-format>).

### Required Roles for Google Workspace and GCP Management

The required roles for Google Workspace User, Group, and Role management are:

- For Google Workspace User and Groups Management - User Management Admin Role and Group Admin Role.
- For Google Workspace Roles Management - Super Admin Role.

The required GCP IAM roles for GCP management are:

- Cloud Asset Viewer
- Organization Role Administrator
- Organization Role Viewer
- Service Account Admin
- Folder IAM Admin
- Organization Administrator
- Project IAM Admin
- Agent Registry Viewer (required for Agent Registry aggregation)
- Super Admin Role (for IAM Role Management and Domain Management)
- Viewer (required for SailPoint NHI Discovery at organization scope)
- Organization Viewer (required for SailPoint NHI Discovery at organization scope)

The necessary granular permissions for the user can be assigned through Service Account Scopes and Built-In Roles for an Impersonated User, or Service Account Scopes and Custom Roles for an Impersonated User.

#### Google Reference Documents

> [!NOTE]
>
> The documents listed in this section are not managed by SailPoint and are subject to change without notice.

Refer to the following resources for more information about the prerequisites:

- [GCP Organization](<https://cloud.google.com/resource-manager/docs/creating-managing-organization>)
- [Admin SDK API](<https://developers.google.com/admin-sdk/directory/v1/guides/prerequisites>)
- [Groups Settings API](<https://developers.google.com/admin-sdk/groups-settings/prerequisites>)
- [Identity and Access Management (IAM) API](<https://cloud.google.com/iam>)
- [Cloud Resource Manager API](<https://cloud.google.com/resource-manager>)
- [Cloud Asset API](<https://cloud.google.com/asset-inventory/docs/quickstart>)
- [Agent Registry roles and permissions](<https://docs.cloud.google.com/agent-registry/roles-permissions>)