Skip to main content

​
What this integration contributes

Google Workspace can contribute normalized user lifecycle, sign-in, MFA, administrative, and data-protection activity. Reviewed examples include:
  • account.compromised — account flagged as compromised
  • data.sensitive.downloaded — downloads sensitive data
  • auth.login.unusual — signs in from unusual contexts
See how integration data becomes signals.

​
What Living Security needs

Enable the Admin SDK APIs and authorize only the scopes the connection reads:
  • https://www.googleapis.com/auth/admin.reports.audit.readonly
  • https://www.googleapis.com/auth/admin.directory.user.readonly
  • https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly

​
Setup

1

Create a Google Cloud service account

Create a dedicated service account, enable domain-wide delegation, and download its JSON key. Store the key securely.
2

Authorize domain-wide delegation

In the Google Admin Console, open Security → Access and data control → API controls → Manage Domain Wide Delegation. Add the service account’s numeric client ID and the three read-only scopes above.
3

Choose the delegated administrator

Select an active Workspace administrator who can read the directory, role assignments, and audit reports. Living Security uses this identity only for delegated API reads.

​
Verify and troubleshoot

Verify that the connection can read one directory user and recent login activity. Google notes that new domain-wide delegation grants can take time to propagate.
Confirm that domain-wide delegation uses the service account’s numeric client ID, not its email address, and that all three scopes match exactly.
Add admin.directory.rolemanagement.readonly to the delegation entry and confirm the delegated administrator can view role assignments.
Confirm that the Admin Reports API is enabled and that the delegated administrator can access audit reporting for the Workspace tenant.
For vendor-side details, see Google’s domain-wide delegation guide.