Google Workspace

Trustle reads users, groups and their members, admin roles and role assignments, and the third-party apps each user authorized from Google Workspace. Trustle can add and remove group members, assign and remove admin roles, suspend and delete users, and revoke a user’s access to a third-party app.

Prerequisites

• A Google Workspace account with the Super Admin role. Only a Super Admin can set up domain-wide delegation.
• A Super Admin account that Trustle can act as. Trustle sends every API call as this user.

Configure Google Workspace

Trustle uses its own Google service account. You do not create a project or a key. You let the Trustle service account act as one of your Super Admins, for the scopes in Step 3.

Step 1: Find the Customer ID

1. Sign in to the Google Admin console as a Super Admin.
2. Go to Account → Account settings.
3. Copy the Customer ID, for example C01abc234.

Step 2: Choose the Super Admin account

1. In the Admin console, go to Directory → Users.
2. Open the account that Trustle acts as.
3. Under Admin roles and privileges, check that the account has the Super Admin role. A delegated admin role is not enough.
4. Copy the email address, for example admin@yourcompany.com.

Step 3: Grant permissions

1. In the Admin console, go to Security → Access and data control → API controls.

2. In Domain-wide delegation, click Manage Domain Wide Delegation. Then click Add new.

3. In Client ID, enter the Trustle client ID: 105511435084235295500.

4. In OAuth scopes, paste the scopes on one line, separated by commas:

   https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.rolemanagement,https://www.googleapis.com/auth/cloud-identity.groups,https://www.googleapis.com/auth/admin.directory.user.security,https://www.googleapis.com/auth/admin.reports.audit.readonly

   The last two scopes are optional. Remove them if you do not use those features:

   Permission	Required	What Trustle does with it
   https://www.googleapis.com/auth/admin.directory.user	Yes	Imports users. Suspends and deletes users. Test Connection uses it.
   https://www.googleapis.com/auth/admin.directory.group	Yes	Imports groups and their members. Adds and removes group members.
   https://www.googleapis.com/auth/admin.directory.rolemanagement	Yes	Imports admin roles and role assignments. Assigns and removes admin roles.
   https://www.googleapis.com/auth/cloud-identity.groups	Yes	Reads group labels, for example which groups are security groups.
   https://www.googleapis.com/auth/admin.directory.user.security	Optional	Lists the third-party apps each user authorized, and revokes that access. Without it, Trustle shows no third-party apps for Google Workspace.
   https://www.googleapis.com/auth/admin.reports.audit.readonly	Optional	Shows the date each user last used a third-party app, the date the user authorized it, and the last sign-in to each SAML app. Without it, these dates stay empty and Trustle lists no SAML apps.

5. Click Authorize.

Trustle does not use admin.directory.customer, admin.directory.group.member, or admin.directory.orgunit. If an earlier version of this page told you to add them, you can remove them from the entry.

Step 4: Collect the values for Trustle

Trustle field	Where to find it in Google Workspace	Example
Customer ID	Account → Account settings → Customer ID	C01abc234
Super Admin Email	The account from Step 2	admin@yourcompany.com

Connect in Trustle

1. In Trustle, go to Connections.
2. Under Identity Providers, find Google Workspace and click Connect.
3. Enter a Connection Name, for example Google Workspace production. Description is optional.
4. Enter the values from Step 4.
5. Keep Use as Identity Provider selected if Google Workspace is the source of your users. Trustle selects it for Google Workspace by default. Trustle allows one identity provider at a time.
6. Click Test Connection.
7. After the test passes, click Save Connection.

Note

Test Connection checks that Trustle can act as the Super Admin and read that user. It does not check the optional scopes. Do the steps in Verify after the first sync.

Verify

1. On the Connections page, open the Google Workspace connection.
2. Wait for the first sync to finish.
3. Check that the user count and the group count match the Admin console.
4. If you granted the optional scopes, check that users show third-party apps.

If something is missing, see Troubleshooting.

Security notes

Note

• Use a Super Admin account that stays active. If the account is suspended or loses the Super Admin role, every sync and change fails.
• Grant only the scopes for the features you use.
• To disconnect Trustle, delete the Trustle client ID from Domain-wide delegation.

Troubleshooting

Test Connection fails

Trustle does not show the reason yet. Check these values:

• Super Admin Email: the account must have the Super Admin role. A delegated admin role fails. Check the spelling, and check that the account is not suspended.
• Customer ID: it must belong to the same organization as the Super Admin. Copy it again from Account settings.
• Client ID: the domain-wide delegation entry must use 105511435084235295500.
• Scopes: the entry must hold the four required scopes, spelled exactly. If one is missing, Google refuses all of them.

Third-party apps are missing

Add https://www.googleapis.com/auth/admin.directory.user.security to the domain-wide delegation entry in Step 3. Trustle shows the data after the next sync.

Last-used dates or SAML apps are missing

Add https://www.googleapis.com/auth/admin.reports.audit.readonly to the domain-wide delegation entry in Step 3. Trustle shows the data after the next sync. The first sync reads the last 90 days of activity.

The sync fails after it worked before

The Super Admin account changed. Check that it still exists, is not suspended, and still has the Super Admin role. To use a different account, update Super Admin Email in the Trustle connection.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the Customer ID. Never send a secret, key, or token.