Google Workspace
Governing Google Workspace users, groups and org units.
SailPoint uses Google Admin SDK APIs to aggregate users and groups and provision membership and account changes.
- Google Workspace connector type: a REST/API-based connector
- Onboarding: aggregate then correlate
- SailPoint can create/suspend Google users and manage group and org-unit membership.
- Common issues covered in troubleshooting
Google Workspace is the productivity backbone for many organisations, so governing who has a Google account, which groups and org units they belong to, and when accounts are suspended, is core lifecycle hygiene. SailPoint aggregates Google users and groups and provisions changes automatically.
Connector type and how it connects
The Google Workspace integration is a REST/API-based connector. It uses the Google Admin SDK APIs authenticated with a service account (domain-wide delegation). As with every connector, the flow is the same: authenticate to Google Workspace, read accounts and entitlements during aggregation, and write changes during provisioning.
Onboarding the source
- 1. Configure the connection and credentials for Google Workspace.
- 2. Map the account schema, mapping Google users, group memberships and organisational units to SailPoint accounts and entitlements.
- 3. Set the correlation logic so Google Workspace accounts attach to the right identities (typically on a stable key such as employee ID or email).
- 4. Run account aggregation and confirm accounts and entitlements load.
- 5. Verify correlation, watching for uncorrelated/orphan accounts.
Provisioning capabilities
SailPoint can create and suspend Google users and manage group and org-unit membership, driven by roles, requests and lifecycle events. Prompt suspension on leaver is a key control and licence saver.
Entitlements and what to govern
Govern group memberships and org-unit placement, which drive access to shared resources and policies. Enrich significant groups as Managed Attributes.
Troubleshooting
When Google Workspace aggregation or provisioning fails, work through the usual causes in order:
- Verify the service account and domain-wide delegation scopes.
- Confirm the delegated admin has rights over the users/groups in scope.
- Check API enablement and quotas in the Google admin console.
- Validate group/OU schema mapping.
Common pitfalls
- Credential expiry (tokens/secrets/certs) silently breaking the connector.
- Insufficient rights on the Google Workspace service account for the operations you need.
- Schema or correlation misconfiguration leaving accounts uncorrelated.