Skip to content

Configuring the Google Workspace SaaS Connector

To connect Google Workspace to Agentic Fabric, you'll create a service account and assign roles to an impersonated user in Google Workspace. This will allow Agentic Fabric to discover GCP Vertex AI agents, API keys, and service accounts and aggregate them as non-human identities and accounts.

Important

If your organization has already configured a Google Workspace SaaS source, you can use the existing source for agent discovery. The fields will be prepopulated with the source's information. You can edit these fields to configure a new integration.

Creating a Service Account in Google Workspace

Before creating a service account, review the Google Workspace connector documentation for information on required prerequisites.

To create a service account:

  1. Follow Google's product documentation to create a service account. You must use an account that has the Create Service Account IAM role. For more information, refer to Identity and Access Management roles and permissions.
  2. Generate a private key for the service account.

  3. Add the following default scopes to the service account through domain-wide delegation.

    Scope Purpose
    https://www.googleapis.com/auth/admin.directory.group Group Provisioning
    https://www.googleapis.com/auth/admin.directory.user User Provisioning
    https://www.googleapis.com/auth/apps.groups.settings Group Settings API
    https://www.googleapis.com/auth/admin.directory.rolemanagement For all roles management operations, including creating roles and role assignments
    https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly For getting and listing roles, privileges, and role assignments
    https://www.googleapis.com/auth/gmail.settings.sharing For Gmail API - Provisioning
    https://www.googleapis.com/auth/cloud-platform
    https://www.googleapis.com/auth/iam    		 For Gmail API - To access GCP-related data
    https://www.googleapis.com/auth/gmail.settings.basic
    https://mail.google.com/
    https://www.googleapis.com/auth/gmail.modify
    https://www.googleapis.com/auth/gmail.readonly    		 For Gmail API - Aggregation
    https://www.googleapis.com/auth/admin.directory.domain For Gmail API - To manage domain as account type in GCP

  4. Grant the service account the additional permissions required for discovering non-human identities.

Assigning Roles to an Impersonated User

Follow the Google Workspace connector documentation to assign roles to an impersonated user. You can assign built-in or custom roles to the impersonated user.

Connecting Google Workspace to Agentic Fabric

  1. Go to the Connect Source step of the Agentic Fabric onboarding experience.
  2. Select Google Workspace from the left pane.

  3. In the Google Workspace section, complete the following:

    • In the Source Name field, enter a unique name for the source.

    • In the Source Owner field, select the identity who will own the source.

    • In the Description field, enter a unique description for the source to distinguish it from similar connections.

  4. In the Configure Authentication section, complete the following:

    • In the Grant Type dropdown list, select Service Account.
    • In the Service Account Email Address field, enter the email address of the service account you created. The email address uses the format SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com.
    • In the Email Address of User to Impersonate field, enter the email address of the impersonated user. This is the user in Google Workspace who has the required access to perform the operations.
    • In the Private Key field, enter the private key you generated and updated to RSA format.
    • In the Private Key Password field, enter the pass phrase for the private key.
    • In the Scopes field, enter the scopes assigned to the service account.
    • In the Google Organization ID field, enter your Google organization ID. Refer to Google's product documentation for information on finding this value.

  5. Select Test Connection to ensure the connection is successful.

  6. If the test is successful, select Aggregate to run an aggregation for the source. Select Exit to skip this step. You can configure aggregations for the source's datasets later in the source's configuration. For information about datasets specific to Google Workspace, refer to the Google Workspace connector documentation.

    A Completed status is now displayed next to the source in the left panel.

  7. Choose another connector to configure or select Continue to proceed to the next onboarding step.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.