IRONCLADHELP CENTERBack to Portal
All docs

Connecting Google Workspace

Overview

Connecting Google Workspace lets Ironclad pull in admin audit activity and Alert Center notifications from your Workspace domain. Unlike Microsoft 365, Google requires you to create your own service account and authorize it — the portal doesn't generate anything for you here, so this guide covers the full setup on the Google side as well as the portal side.

Before you start: You'll need Super Admin access to your Google Workspace Admin console, and the ability to create a project and service account in Google Cloud Console (a free Cloud project is enough — no billing is required for this).

Step 1: Create a Google Cloud service account

  1. Go to Google Cloud Console and create a new project (or use an existing one dedicated to integrations).
  2. Enable the Admin SDK API and the Alert Center API for that project.
  3. Go to IAM & Admin > Service Accounts and create a new service account (a name like ironclad-workspace-reader works well).
  4. Open the new service account, go to the Keys tab, and create a new key of type JSON. This downloads a JSON key file — keep it safe, you'll paste its contents into the portal shortly.
  5. Note the service account's Client ID (a long numeric ID shown on its details page) — you'll need it in the next step.

Step 2: Authorize domain-wide delegation

  1. In the Google Workspace Admin console, go to Security > API controls > Domain-wide delegation.
  2. Click Add new.
  3. Paste in the service account's Client ID from Step 1.
  4. Under OAuth scopes, add the following three scopes:
Scope Purpose
https://www.googleapis.com/auth/admin.reports.audit.readonly Read admin audit log activity
https://www.googleapis.com/auth/admin.reports.usage.readonly Read Workspace usage reports
https://www.googleapis.com/auth/apps.alerts Read Alert Center notifications
  1. Click Authorize.

Step 3: Connect it in the portal

  1. Log in to the Ironclad portal.
  2. Make sure the correct customer is selected in the scope bar at the top.
  3. In the left sidebar, under Administration, click Integrations.
  4. Find the Google Workspace card and fill in:
Field What to enter
Admin Email The email address of a Workspace admin the service account should impersonate when reading data.
Service Account Key (JSON) Paste the full contents of the JSON key file you downloaded in Step 1.
  1. Check the Enabled checkbox.
  2. Click Save. You'll see a brief Saved confirmation.

Credential fields like the Service Account Key are write-only. Once saved, the portal shows a mask plus only the final three characters, so you can confirm which key is configured without exposing the full value. Re-enter it only when rotating or replacing the key.

Step 4: Confirm it's working

Once saved and enabled, Ironclad begins pulling Workspace audit and Alert Center activity on a regular interval. Check your Ironclad SIEM dashboard for Google Workspace events to confirm data is flowing — it can take a little while for the first events to appear.

Troubleshooting

  • No data after saving: double-check the domain-wide delegation scopes in Step 2 exactly match the three scopes listed above — a typo in a scope silently blocks that scope's data, not just an error. If you add a scope to an existing authorization, a Workspace Super Admin for that customer must authorize the updated scopes again; a Decian administrator cannot grant this customer consent on their behalf.
  • Authorization errors: confirm the Client ID authorized in Step 2 belongs to the same service account whose JSON key you pasted into the portal — mismatches between the two are the most common cause of failures.
  • Admin Email rejected: the address must belong to an actual admin in your Workspace domain; the service account impersonates that user to read the data.