Supported Features and Prerequisites
Supported Features
The SailPoint Google Workspace connector supports the following features:
Important
You must purchase a SailPoint Cloud Infrastructure Entitlement Management (CIEM) license to enable Google Cloud Platform (GCP) features. Contact your SailPoint Customer Success Manager for more information and to request access.
Note
Before you can use an item marked with an asterisk (*), SailPoint must activate the feature for your site.
- Aggregation of Google Workspace accounts (user, service account, domain)
- *Provisioning of Google Workspace accounts (user, service account, domain)
- *Access Certifications (certification of entitlements connected to accounts)
- Delta Aggregation
- HTTP and HTTPS proxy configurations
- Archive and unarchive Google Workspace users
- Delete Accounts
- Filtering of user records during full and delta aggregation. Refer to Advanced Settings for more information.
Note
Archive and unarchive features apply only to Google Workspace users from the managed system. They do not apply to other account types.
Multiple Account Type Support
The following table details the supported feature set for each account type:
| Feature | Google Workspace User/Cloud Identity | Service Account | Domain |
|---|---|---|---|
| Aggregate | Yes | Yes | Yes |
| Create | Yes | Yes | Yes |
| Password Management | Yes | N/A | N/A |
| Enable and Disable | Yes | Yes | N/A |
| Group Entitlements (Read, Request, and Revoke) | Groups, roles, and resource permission | Resource permission | Resource permission |
| Archive and Unarchive | Yes | N/A | N/A |
Group Entitlements
SailPoint is capable of aggregating additional details of Group Entitlements from the managed system. These objects have a separate schema which defines a list of attributes. Aggregation tasks fetch the defined attributes as additional details when it runs aggregation processes for a specific Group Entitlement type.
Supported Google Workspace objects include:
- Groups
- Roles
- Resource Permissions
Note
Only Group, Role, and Resource Permissions can be requested as multiple group entitlements.
Supported GCP objects include:
- IAM Roles
- Projects
- Folders
- Resource Permissions
Google Workspace Groups are both accounts and entitlements in GCP support. GCP entitlement resource permissions can be assigned to Google Workspace Groups.
Support for Managing Google Cloud Objects
The Google Workspace connector can manage the following Google Cloud objects:
- Google Accounts (Google Workspace Identities and managed Cloud Identities only)
- Service Accounts
- Domains (Google Workspace or Cloud Identity Domain)
- Google Groups
Supported Authentication Methods
The Google Workspace connector supports the following authentication and authorization methods:
- Client Credentials (OAuth 2.0 for Web Server Applications)
- Service Account (OAuth 2.0 for Server to Server Applications)
Support for Multiple Group Objects
The Google Workspace connector supports multiple group objects. Entitlement aggregation is supported for the following:
- Groups
- Roles
- IAM Roles
- Projects
- Folders
- Resource Permissions
Privilege Classification
SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.
| Privilege Level | Description |
|---|---|
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |
Note
To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.
For more information, refer to Managing Privilege Classification.
Supported Features Comparison with Cloud Governance
Important
To enable additional cloud governance features (for example, visualization of effective access) for your GCP Cloud Infrastructure, you must have a CIEM license. If you already have a Cloud Access Management license, no additional license purchase is required. Contact your SailPoint Customer Success Manager to request access and for more information.
| Supported Features | Google Workspace Connector (Standard Features) | Google Workspace Connector (with Cloud Governance) |
|---|---|---|
| Account Management: Manage Google Workspace Users as Accounts Aggregate, Refresh Accounts, Aggregate and Provision Custom Schema Attributes Create, Update, Delete Enable, Disable, and Change Password Add and Remove Entitlements Manages Delegated Administrators and Alias on Accounts Move User to Other Organization Unit |
Yes | Yes |
| GCP Accounts: Service Account Domain (Google Workspace or Cloud Identity Domain) |
No | Yes |
| Group Management: Manage Google Workspace Groups as Account - Groups Aggregate and Refresh Group |
Yes | Yes |
| Role Management: Manage Google Workspace Roles as Account - Roles Aggregate and Refresh Roles |
Yes | Yes |
| IAM Role Management: Manage GCP IAM Roles as IAMRole Aggregate and Refresh Role |
No | Yes |
| Project Management: Manage GCP Project as Project Aggregate and Refresh Manages Delegated Administrators (Supported with Service Account Authorization Only) and Alias on Accounts |
No | Yes |
| Folder Management: Manage GCP Folder as Folder Aggregate and Refresh |
No | Yes |
| IAM Resource Permission Management: Manage GCP Resource Permission as iamResourcePermission Aggregate and Refresh |
No | Yes |
Password Management
If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:
- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.
For more information on configuring password management, refer to Password Management Overview.
Prerequisites
-
A working instance of Google Workspace.
-
Configure at least one virtual appliance cluster and successfully test the connection. Refer to the Virtual Appliance Reference Guide for more information.
OAuth 2.0 Authentication Methods
The Google Workspace connector uses the OAuth 2.0 protocol for API authentication and authorization, supporting the following two scenarios:
- Client Credentials (OAuth 2.0 for Web Server Applications)
-
Service Account (OAuth 2.0 for Server to Server Applications)
Note
SailPoint's Cloud Infrastructure Entitlement Management (CIEM) only supports Service Account as a grant type. Refer to Service Account Authentication Settings for more information.
API Access Permissions via Roles
API access permissions are assigned to the Google Workspace user via roles, based on the type of credentials used:
- Client Credentials - API access is performed on behalf of the Google Workspace user under whose context the credentials are generated. This user provides consent while generating the refresh token. Refer to Required Roles for Google Workspace and GCP Management for more information.
- Service Account - API access is performed on behalf of an impersonating user. The roles assigned to the impersonating user take priority over the roles assigned directly to the Service Account. Refer to Required Roles for Google Workspace and GCP Management for more information.
Refer to Generating OAuth 2.0 Credentials for information on generating Client Credentials and a Service Account.
Required Roles for Google Workspace and GCP Management
The required roles for Google Workspace User, Group, and Role management are:
- For Google Workspace User and Groups Management - User Management Admin Role and Group Admin Role.
- For Google Workspace Roles Management - Super Admin Role.
The required GCP IAM roles for GCP management are:
- Cloud Asset Viewer
- Organization Role Administrator
- Service Account Admin
- Folder IAM Admin
- Organization Administrator
- Project IAM Admin
- Super Admin Role (for IAM Role Management and Domain Management)
The necessary granular permissions for the user can be assigned through Service Account Scopes and Built-In Roles for an Impersonated User, or Service Account Scopes and Custom Roles for an Impersonated User.
Google Reference Documents
Note
The documents listed in this section are not managed by SailPoint and are subject to change without notice.
Refer to the following resources for more information about the prerequisites:
- GCP Organization
- Admin SDK API
- Groups Settings API
- Identity and Access Management (IAM) API
- Cloud Resource Manager API
- Cloud Asset API
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.