Connectors · Lesson

Google Workspace

Quick answer

SailPoint uses Google Admin SDK APIs to aggregate users and groups and provision membership and account changes.

Key takeaways

Google Workspace connector type: a REST/API-based connector
Onboarding: aggregate then correlate
SailPoint can create/suspend Google users and manage group and org-unit membership.
Common issues covered in troubleshooting

Google Workspace is the productivity backbone for many organisations, so governing who has a Google account, which groups and org units they belong to, and when accounts are suspended, is core lifecycle hygiene. SailPoint aggregates Google users and groups and provisions changes automatically.

Connector type and how it connects

The Google Workspace integration is a REST/API-based connector. It uses the Google Admin SDK APIs authenticated with a service account (domain-wide delegation). As with every connector, the flow is the same: authenticate to Google Workspace, read accounts and entitlements during aggregation, and write changes during provisioning.

Onboarding the source

1. Configure the connection and credentials for Google Workspace.
2. Map the account schema, mapping Google users, group memberships and organisational units to SailPoint accounts and entitlements.
3. Set the correlation logic so Google Workspace accounts attach to the right identities (typically on a stable key such as employee ID or email).
4. Run account aggregation and confirm accounts and entitlements load.
5. Verify correlation, watching for uncorrelated/orphan accounts.

Provisioning capabilities

SailPoint can create and suspend Google users and manage group and org-unit membership, driven by roles, requests and lifecycle events. Prompt suspension on leaver is a key control and licence saver.

Entitlements and what to govern

Govern group memberships and org-unit placement, which drive access to shared resources and policies. Enrich significant groups as Managed Attributes.

Troubleshooting

When Google Workspace aggregation or provisioning fails, work through the usual causes in order:

Verify the service account and domain-wide delegation scopes.
Confirm the delegated admin has rights over the users/groups in scope.
Check API enablement and quotas in the Google admin console.
Validate group/OU schema mapping.

Common pitfalls

Credential expiry (tokens/secrets/certs) silently breaking the connector.
Insufficient rights on the Google Workspace service account for the operations you need.
Schema or correlation misconfiguration leaving accounts uncorrelated.

Want to learn this properly?

Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.

See the course Ask a question

Check your understanding

What type of connector is Google Workspace?
- A. Credentials, network/firewall access and schema mapping.
- B. a REST/API-based connector. It uses the Google Admin SDK with a service account.
- C. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
Show answer
B. a REST/API-based connector. It uses the Google Admin SDK with a service account.
a REST/API-based connector. It uses the Google Admin SDK with a service account.
What is the first onboarding step for Google Workspace?
- A. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
- B. Credentials, network/firewall access and schema mapping.
- C. a REST/API-based connector. It uses the Google Admin SDK with a service account.
Show answer
A. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
Configure the connection and credentials, then aggregate accounts and correlate them to identities.
Where do most Google Workspace connector issues come from?
- A. Configure the connection and credentials, then aggregate accounts and correlate them to identities.
- B. Credentials, network/firewall access and schema mapping.
- C. a REST/API-based connector. It uses the Google Admin SDK with a service account.
Show answer
B. Credentials, network/firewall access and schema mapping.
Credentials, network/firewall access and schema mapping.

Frequently asked questions

What does the term Google Workspace connector refer to in SailPoint?

What is another point to note about Google Workspace connector?

As with every connector, the flow is the same: authenticate to Google Workspace, read accounts and entitlements during aggregation, and write changes during provisioning.

What tends to go wrong with Google Workspace connector?

Credential expiry (tokens/secrets/certs) silently breaking the connector. Insufficient rights on the Google Workspace service account for the operations you need. Schema or correlation misconfiguration leaving accounts uncorrelated.