Google Workspace
Connect Google Workspace so Safeguard can check users, sign-in policies, email authentication and Drive sharing.
Connect Google Workspace
Safeguard reads your Google Workspace directory and policies with read-only access: users and admins, 2-Step Verification and password policies, session length, third-party app access, external Drive sharing, and the SPF, DKIM and DMARC records of your domains.
There are two cards:
- Google Workspace: users, admins, policies and email authentication. The Drive sharing policy is checked here too.
- Google Drive: a separate connection that collects Drive evidence, with the
drive.readonlygrant. It can also connect Google's Drive MCP server for Search.
Choose a sign-in
| OAuth | Service account with domain-wide delegation | |
|---|---|---|
| Who sets it up | A Google Workspace administrator signs in and approves | A Google Cloud project owner and a Workspace super admin |
| Scopes | admin.directory.user.readonly, admin.directory.domain.readonly, admin.directory.device.mobile.readonly | The scopes you delegate (below) |
| Policy checks (password, 2-Step Verification, session length, third-party apps, Drive sharing) | Not covered: OAuth does not request the Cloud Identity policy scope | Covered with cloud-identity.policies.readonly |
Use the service account if you want every check. OAuth is quicker and covers users, admins, inactive and departed accounts, and email authentication.
Option A: OAuth
- In Safeguard, open Compliance › Connectors, search for Google Workspace and click Connect.
- Choose OAuth and sign in with a Google Workspace administrator account. The directory is visible only to administrators.
- Approve the read-only scopes. The card shows Verified once Google confirms the grant.
Option B: Service account with domain-wide delegation
-
In the Google Cloud console, create a service account in a project you control and create a JSON key for it.
-
In the Google Admin console, open Security › API controls › Domain-wide delegation and add the service account's client ID with these read-only scopes:
https://www.googleapis.com/auth/admin.directory.user.readonlyhttps://www.googleapis.com/auth/admin.directory.domain.readonlyhttps://www.googleapis.com/auth/admin.directory.user.security(for the check on departed users who still hold OAuth tokens)https://www.googleapis.com/auth/cloud-identity.policies.readonly(for the policy checks)https://www.googleapis.com/auth/admin.directory.device.mobile.readonly(for mobile device checks)
Google's guide: Control API access with domain-wide delegation.
-
In Safeguard, open Compliance › Connectors › Google Workspace › Connect and choose API token:
| Field | What to enter |
|---|---|
| Service account key (JSON) | The full JSON key file |
| Admin email to impersonate | An administrator's address, for example admin@your-domain.com. The service account reads as this admin. |
| OAuth access token (optional) | Leave empty. It is an alternative for a short-lived token with Admin SDK Directory scopes. |
A scope you did not delegate affects only the checks that need it: those show an error naming the scope to add under Domain-wide delegation, and the rest still run.
Google Drive
Connect the Google Drive card with OAuth (scope drive.readonly) or the same service account form. The external sharing check itself comes from the Google Workspace connection's policy read, so connect Google Workspace with the service account if you need it.
What Safeguard checks
- 2-Step Verification enforced, and weak second factors disabled
- Administrators: how many, and whether they use phishing-resistant MFA
- Password policy and session length
- Inactive users, and departed users who are still active or still hold OAuth tokens
- Third-party app access restrictions
- External Drive sharing
- SPF, DKIM and DMARC on your domains, read from public DNS
Policies are judged for every organizational unit and group they target, so a weaker setting on a sub-unit is not hidden by a strong top-level one.
Troubleshooting
- Not working, naming a scope: delegate that scope under Domain-wide delegation, or switch from OAuth to the service account for policy checks.
- Not working with a service account: check that the admin email is an administrator in the same Workspace, and that the JSON key belongs to the service account you delegated.