Set up Google Workspace integration and get all the insights in Torii's dashboard

Overview

Torii integrates with Google Workspace (G Suite) and syncs:

• User list
• Licenses
• 3rd party application list
• 3rd party permissions
• Usage data
• Events

Connecting the integration consists of the following.

Prerequisites

• For Torii to sync Google Workspace data, API Access must be enabled on Google Workspace. See the following guide provided by Google: Enable API access in the Admin console.
• For Torii to pull usage from G Suite and sync events, Read-only access is required when retrieving an activity report OAuth scope (https://www.googleapis.com/auth/admin.reports.audit.readonly).
  Without this scope, Torii cannot retrieve the required information regarding activity events.
• To use Torii to perform actions in Google workspace, see here.
• Torii's Google integration supports granular permission levels. You may allow or deny any requested scopes for this integration, but denying scopes will negatively affect the integration and your capability to receive information or perform actions through it. see this table for more information.

Connect Google Workspace integration 

1. From the Torii Integrations page, click on the Google Workspace tile
2. Click Connect
   

3. Your Google Workspace account can be integrated as:

   • • "Read-Only" to see your Google Workspace data within Torii
     • "Read/Take Action" to create workflows and take action directly through Torii
       
       Step 4, which includes the "Service Account Email Address" and "Service Account Private Key," are optional, but if you want to use the below actions, you must populate them.
4. Click here to see the "how-to instructions."
   • Set Vacation Responder
   • Enable Auto Forwarding
   • Update Gmail Signature 
     Company-owned devices actions 
   • Block company-owned mobile devices
   • Wipe Google account from company-owned mobile devices
   • Delete company-owned mobile devices from Google workspace
5. Click Connect
   
   
6. The "Test Connection" window will display, generating the connection test.
   Click Connect to continue.
   
7. Once the integration is connected and synced, a green checkbox is displayed.
   

Google settings required for actions:

To enable the Google Integration for Advanced Actions such as Google Signature, you will need to enable API Access from Google into Torii.

1. Go to your Google Cloud Console: https://console.cloud.google.com/apis/api/gmail.googleapis.com/overview
2. If you don’t have a project, click “Select a project”>> NEW PROJECT.
   
3. Enter a Project Name ie. “Torii Project”
4. Select your Organization and Click CREATE
   
5. Click on “ENABLE APIS AND SERVICES”
   
6. To enable Set Vacation Responder, Enable Auto Forwarding, Update Gmail Signature and Share User's Email actions:
   Search for “gmail”, select "Gmail API," and click ENABLE
   You should now see the status as Enabled. https://console.cloud.google.com/apis/api/gmail.googleapis.com/overview
   
7. To enable Share Google calendars, Remove access to shared calendars and Delete calendar events, search for "calendar", select Google calendar API an click ENABLE

        You should now see the status as Enabled

9. To enable Remove user from all shared drives, select Google Drive API and click ENABLE

10. To enable Block company-owned mobile devices, Wipe Google account from company-owned mobile devices, and Delete company-owned mobile devices actions:
Search for “Cloud identity”, select "cloud identity," and click ENABLE

11. Click on Credentials

12. Go to + CREATE CREDENTIALS and select Service account. 

13. Provide the Service Account details and click Done.

14. After editing the Service Account details, click the “Keys” tab

15. Click Add Key → Create New Key → Create

16. In the "Create private key" window, leave the default JSON and click CREATE

17. The JSON will be downloaded automatically to your computer:

18. In the Google Admin Console >> Security >> Access and Data Control >> API Controls >> Manage Domain Wide Delegation (Scroll Down)

19. Click Add New

20. Add your Client ID (from your JSON), add the required scopes, and click Authorize.

• • For Set Vacation Responder action - https://www.googleapis.com/auth/gmail.settings.basic
  • For Enable Auto Forwarding action - https://www.googleapis.com/auth/gmail.settings.sharing
  • For Update Gmail Signature action - https://www.googleapis.com/auth/gmail.settings.basic
  • For modifying non-primary emails: https://www.googleapis.com/auth/gmail.settings.sharing 
  • For Company-owned mobile devices actions - https://www.googleapis.com/auth/cloud-identity.devices
  • For Share user's email action - https://www.googleapis.com/auth/gmail.settings.sharing and https://www.googleapis.com/auth/gmail.settings.basic
  • For Share Google calendars, Remove access to shared calendars and Delete calendar events actions -  https://www.googleapis.com/auth/calendar
  • For Remove user from all shared drives action - https://www.googleapis.com/auth/drive

21. Enter the Service Account Email Address

22. Add the Service Account Private Key; please add the Service Account Private Key; make sure to copy the entire key as shown in the image.

23. Enter the Service Account Email Address and Service Account Private Key to the "Connect Google Workspace" window", and click Connect.

Delegate user's email action - more prerequisites

1. Sign in to the Admin console.
2. Navigate to Apps > Google Workspace > Gmail > User settings > Mail delegation.
3. Check the "Let users delegate access to their mailbox to other users in the domain" box.
4. Save changes. Changes can take up to 24 hours.

Enable auto forwarding action - more prerequisites

To enable auto-forwarding for users in your organization:

1. Sign in to the Google Admin console using an administrator account.
2. Navigate to Apps > Google Workspace > Gmail > End User Access.
3. Uncheck Allow users to automatically forward email to another address.
4. Click Save.

For detailed instructions, visit Google Support.

Remove User from all shared drives - additional information

There may be cases where this action will fail, based on what permissions the user being removed has, and the status of the drives to be removed from:

1. To run this action, Torii finds the organizer of the shared drive, and runs the remove user action via their user. As such:
   1. In the rare case that the shared drive does not have an organizer, or that the organizer of the shared drive is a group, the action will fail. 
   2. If the shared drive organizer is from another organization (such as a folder shared between companies), Torii won't be able to take action of their behalf and the action will fail. 
   3. In both cases, the details section will explain these issues. 
2. If the user does not have direct permission to the shared drive, but can access it due anyways, such as due to being a member of a group, the user will not be removed from the shared drive.
   1. If this is the only issue that comes up while running the action, the action will be marked as having been run successfully (even though the user was not removed).
   2. If any additional issue comes up, the action will be marked as failed. 
   3. In either case, the details section will note that the user was not removed and why. 

Mobile device actions

Company-owned devices actions

These actions require special permissions, as mentioned above; they are executed on all the company-owned devices assigned to the selected user.

• Block company-owned mobile devices- Block access to the organization’s Google account from the devices
• Wipe Google account from company-owned mobile devices- Deletes all of your organization’s data from the devices.
• Delete company-owned mobile devices from Google workspace- Removes the devices from the Google Workspace list.

User-owned devices actions:

These actions do not require any special permissions (except for "Read and take"). The actions are executed on all the user-owned devices assigned to the selected user.

• Block user-owned mobile devices- Block access to the organization’s Google account from the devices.
• Wipe Google account from user-owned mobile devices- Deletes all of your organization’s data from the devices.
• Delete user-owned mobile devices from Google workspace- Removes the devices from the Google Workspace list.

Read-only

In case you choose to connect to Google Workspace for "Read-only", Torii will require the following permissions:NOTE: Google documents that a Google Super Administrator user is required to read licenses data in Google's access control policy:
"License Management — This privilege works only in the Admin console and authorizes only super admins to use the License Manager API."

However, we found that creating a dedicated admin role that is not a Super Administrator allows reading the License management.
If you have created a dedicated Super Admin user for the integration, make sure you log in with that user and accept any Google Terms of Service.
Without accepting the Terms of Service, Torii's access will be limited.

Read and take action.

In case you choose to connect Google Workspace for Read and take actions, you will grant Torii the following permissions:
Return up

List of requested scopes for Torii's Google Workspace integration

Return up

Integration Capabilities and Actions 

You can stay updated about application information and actions from our Integrations Page >> Integration Capabilities button (1) >> Integration Capabilities table.

Usage

Torii pulls 2 types of usage events and calculates Google Workspace usage based on them:

• SAML Audit activity events - Usage for apps connected to G-Suite SSO

• Login Audit Activity Events - General usage for Google Workspace, for example, 2-step verification enrollment change, Account password change, etc.

Torii will pull activity events from the last 30 days on the first usage sync.

Events

Torii continuously monitors Google events and updates data in Torii in real-time accordingly. The Google events that Torii monitors are:

• User was deleted
• User was suspended
• User was archived

If you set Google as the user lifecycle source of truth, the Offboarding To-Do list in Torii will be continuously updated based on the events above.

You can also leverage Torii's App Event workflow trigger to trigger automation based on the above events whenever an event happens in Google Workspace.

Troubleshooting

Authorization Error

You might encounter the following Authorization Error

Resolution

1. From Google Admin page, go to Security
2. API controls
3. MANAGE THIRD-PARTY APP ACCESS
4. Click on Add app
5. Select the OAuth App Name OR Client ID option
6. Search for Torii

7. Click Select

   

8. Check all Client ID boxes

   
9. Select the Trusted option

10. Click Configure

    

Q&A

Q: What data is transferred using the "Transfer Google Workspace Data Studio" action?

A: The data transferred is:

• https://datastudio.google.com/u/0/navigation/datasources
• https://datastudio.google.com/u/0/navigation/reporting
  

Q: Why can't I use the @import command when updating a user's signature?

A: We currently have a limitation on this action regarding the Signature field. If the signature is in HTML format, we cannot utilize the '@import' command due to the '@' sign being used for mentions in workflow actions fields, such as 'Trigger.User.FirstName'.

Q: What happens if I run an action on a user's alias in Google Workspace? e.g. user1@gmail.com is an alias for user2@gmail.com. What happens when I run Google Workspace actions on user1@gmail.com? 
A: Google treats both the user's primary email address, as well as their aliases as the same user. This means that if you take action on a user's alias (via Torii workflows or otherwise), you will be taking action on the entire user. For example, if you remove a user from all groups, and that email address is an alias for another user, then the primary user will also be removed from all Google groups.

We recommend taking any action that involves removing permissions/access for users (such as upon termination) before turning them into aliases for other users.  

Related articles 

Torii “Read-Only” Integration with Google Workspace Tenant