Google Workspace
Connect Google Workspace to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Google Workspace to collect identity & sso evidence automatically.
Step-by-step guide: Connect Google Workspace.
| Category | Identity & SSO |
| Connect with | OAuth, API token |
| What a connection produces | Automated evidence collection |
Connect with OAuth
Before you start, an administrator of Google Workspace must allow third-party apps:
- If your Admin console restricts unconfigured apps: go to Menu › Security › Access and data control › API controls and click Manage App Access.
- Click Configure new app, enter Safeguard's app name or OAuth client ID and click Search, then select it.
- Choose the organizational units it applies to (or leave the default for all users), select Trusted, and click Continue, then Finish.
- By default Allow users to access any third-party apps is set, so no step is needed unless you changed the Unconfigured third-party apps setting.
- On Compliance › Connectors, open Google Workspace, click Connect and choose OAuth.
- Sign in to Google Workspace and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for
https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly. - You return to Safeguard, and the card shows Verified once the first check succeeds.
Connect with an API token
-
In Google Workspace:
- In the Google Cloud console, go to Menu › IAM & Admin › Service Accounts and select your project.
- Click Create service account, enter a name, and click Create and continue; skip optional roles and click Done.
- Click the service account's email address, select the Keys tab, and click Add key › Create new key.
- Choose JSON and click Create. The key file downloads to your machine; it is the only copy and cannot be downloaded again.
- On the service account's details page, click Show advanced settings and copy the Client ID under Domain-wide delegation.
- In the Google Admin console, go to Menu › Security › Access and data control › API controls › Manage Domain Wide Delegation.
- Click Add new, paste the service account's Client ID, enter the read-only scopes comma-delimited: https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly, and click Authorize.
Where to find the other values:
- Admin email to impersonate: The email address of a Google Workspace administrator in your domain who can read users, domains and devices.
Google Workspace shows the secret only once, so copy it before you leave the page.
The Admin SDK API must be enabled in the Cloud project used for the service account (not quoted on the fetched page). Domain-wide delegation needs a super administrator. The optional OAuth access token is a short-lived alternative and stops working when it expires.
Source: developers.google.com, knowledge.workspace.google.com, checked 2026-10-07.
-
On Compliance › Connectors, open Google Workspace, click Connect, choose API token and fill in:
Field What to enter Service account key (JSON) Optional. Domain-wide delegation service account with Admin SDK Directory read-only scopes. Stored encrypted and never shown again. Admin email to impersonate Optional. OAuth access token (optional) Alternative: paste a short-lived OAuth token with Admin SDK Directory scopes. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Google Workspace and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | C1.1, CC6.1, CC6.2, CC6.3, CC6.5, CC6.6, CC6.7, CC6.8, CC7.1, CC7.2, CC9.2 | 28 |
| ISO/IEC 27001 | Automated tests | A.5.9, A.5.11, A.5.14, A.5.16, A.5.17, A.5.18, A.5.19, A.6.5, A.8.1, A.8.2, A.8.3, A.8.5, A.8.7, A.8.8, A.8.9, A.8.12, A.8.16, A.8.20, A.8.24 | 28 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(b)(1), 164.310(d)(1), 164.312(a)(1), 164.312(d), 164.312(e)(1) | 24 |
| PCI DSS | Automated tests | 1.5.1, 3.5.1, 5.2.1, 5.4.1, 6.3.3, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.1, 8.4.2, 10.4.1, 12.5.1 | 22 |
| NIST CSF 2.0 | Automated tests | DE.CM-03, DE.CM-09, GV.SC-04, GV.SC-05, ID.AM-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.IR-01, PR.PS-02 | 24 |
These tests are switched on per workspace by the Safeguard team.
Google Cloud Identity, Google SSO connect to the same provider as Google Workspace, and these tests run for a connection made through any of them.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks