About

The Google Workspace integration brings the users from your Google Workspace directory into ControlMap. It helps you show an auditor who has an account, who has administrator access, and whether each person is enrolled in 2-step verification (multi-factor authentication). ControlMap collects the data on a schedule, so you don't have to export it by hand.

For each user, ControlMap collects:

• Name and primary email address
• Whether the account is active or archived
• Whether the user is an administrator, including delegated administrators
• Whether the user is enrolled in 2-step verification and whether it is enforced

The integration runs these compliance checks:

• All user accounts in Google Workspace must have an owner
• All admin user accounts in Google Workspace must have MFA enrolled
• All user accounts in Google Workspace must have MFA enrolled

Before you start

ControlMap connects to Google Workspace with a service account, not with a personal Google account. Have these ready:

• Setting up integrations from the client portal is part of the Pro plan. For details, see the Free, Essentials and Pro plans article.
• The JSON file with the service account credentials
• An email address in your Google directory that has permission to read users and their details. It can be any email address in your directory, as long as it has the required read permissions.
• The domain configured for your Google Workspace

If you don't manage your Google Cloud and Workspace settings yourself, ask the administrator who does to provide these.

Connect Google Workspace

1. Go to Monitor › Integrations and select Add Integration.
2. Search for Google Workspace and select the Google Workspace card. It is listed under Identity Providers.

3. On the Connection step, enter a Connection Name. This field is required.
4. Under Credentials, select Choose File and choose the JSON file with the service account credentials. The file name and size show next to the button.
5. In Email address, enter the email address that has permission to read users and their details.
6. In Domain Name, enter the domain configured for your Google Workspace.
7. Optional: tick Create an employee record for each user discovered from Google Workspace. Each discovered user then becomes a person in ControlMap. When this is ticked, you can also tick Provide ControlMap access to discovered users., which gives users minimal access to My Compliance Portal for policies and other onboarding tasks.
8. Select Next: Checks.

Complete the remaining steps as described in the Connect an integration article: Checks, Watchers and Schedule. Google Workspace has no Inclusions & Exclusions step.

What you'll see after connecting

After the first scan, Google Workspace's data appears in two places in Monitor:

• User Accounts: each Google Workspace user. The Integration column and filter tell your Google Workspace connection apart from your other connections. If you ticked the employee option, each account is linked to the matching person. An account with no matching person is shown as an orphan account.
• Compliance Checks: the three Google Workspace checks. Each check shows No Data until the first scan has finished.

Disconnect or change settings

• To change the credentials, email address, domain, schedule or watchers, open the connection from Monitor › Integrations and use its tabs, as described in the Connect an integration article. On an existing connection you can leave the credentials file empty to keep the saved one. Rename the connection with Edit name next to its name.
• To remove Google Workspace, select the bin icon on its card in Monitor › Integrations and confirm. This also deletes the assets and their compliance status.