Set up Google Workspace integration and get all the insights in Torii's dashboard
Torii integrates with Google Workspace (G Suite) and syncs:
- User list
- 3rd party application list
- 3rd party permissions
- Usage data
Connecting the integration consists of the following.
- For Torii to sync Google Workspace data, API Access must be enabled on Google Workspace. See the following guide provided by Google: Enable API access in the Admin console.
- Make sure the Gmail API/Service is enabled here - https://console.cloud.google.com/apis/api/gmail.googleapis.com/overview
For Torii to pull usage from G Suite, Read-only access is required when retrieving an activity report OAuth scope (
Without this scope, Torii cannot retrieve the required information regarding activity events.
- To use Torii to perform actions in Google workspace, see here.
Connect Google Workspace integration.
- From the Torii Integrations page, click on the Google Workspace tile
- Click Connect
Your Google Workspace account can be integrated as:
Step 4, which includes the "Service Account Email Address" and "Service Account Private Key", are optional, but if you want to use the below actions, you will have to populate them.
Click here to see the "how-to instructions".
- Set Vacation Responder
- Enable Auto Forwarding
- Update Gmail Signature
- Company-owned devices actions
- Block company-owned mobile devices
- Wipe Google account from company-owned mobile devices
- Delete company-owned mobile devices from Google workspace
- Click Connect
- Once the integration is connected and synced, a green checkbox is displayed.
Google settings required for actions:
To enable the Google Integration for Advanced Actions such as Google Signature, you will need to enable API Access from Google into Torii.
- Go to your Google Cloud Console: https://console.cloud.google.com/apis/api/gmail.googleapis.com/overview
- If you don’t have a project, click “Select a project”>> NEW PROJECT.
- Enter a Project Name ie. “Torii Project”
- Select your Organization and Click CREATE
- Click on “ENABLE APIS AND SERVICES”
- Search for “gmail” and select "Gmail API."
- Click on ENABLE
- You should now see the status as Enabled.
- Provide the Service Account details and click Done.
- After editing the Service Account details, click the “Keys” tab
- Click Add Key → Create New Key → Create
- In the "Create private key" window, leave the default JSON and click CREATE
- The JSON will be downloaded automatically to your computer:
- In the Google Admin Console >> Security >> Access and Data Control >> API Controls >> Manage Domain Wide Delegation (Scroll Down)
- Click Add New
- Add your Client ID (from your JSON), add the required scopes, and click Authorize.
- For Set Vacation Responder action - https://www.googleapis.com/auth/gmail.settings.basic
- For Enable Auto Forwarding action - https://www.googleapis.com/auth/gmail.settings.sharing
- For Update Gmail Signature action - https://www.googleapis.com/auth/gmail.settings.basic
- For Company-owned mobile devices actions - https://www.googleapis.com/auth/cloud-identity.devices
- Enter the Service Account Email Address
- Add the Service Account Private Key; please add the Service Account Private Key; make sure to copy the entire key as shown in the image.
- Enter the Service Account Email Address and Service Account Private Key to the "Connect Google Workspace" window", and click Connect.
Mobile device actions
Company-owned devices actions
These actions require special permissions, as mentioned above; they are executed on all the company-owned devices assigned to the selected user.
- Block company-owned mobile devices- Block access to the organization’s Google account from the devices
- Wipe Google account from company-owned mobile devices- Deletes all of your organization’s data from the devices.
- Delete company-owned mobile devices from Google workspace- Removes the devices from the Google Workspace list.
User-owned devices actions:
These actions do not require any special permissions (except for "Read and take"). The actions are executed on all the user-owned devices assigned to the selected user.
- Block user-owned mobile devices- Block access to the organization’s Google account from the devices.
- Wipe Google account from user-owned mobile devices- Deletes all of your organization’s data from the devices.
- Delete user-owned mobile devices from Google workspace- Removes the devices from the Google Workspace list.
In case you choose to connect to Google Workspace for "Read-only", Torii will require the following permissions:NOTE: Google documents that a Google Super Administrator user is required to read licenses data in Google's access control policy:
"License Management — This privilege works only in the Admin console and authorizes only super admins to use the License Manager API."
However, we found that creating a dedicated admin role that is not a Super Administrator allows reading the License management.
If you have created a dedicated Super Admin user for the integration, make sure you log in with that user and accept any Google Terms of Service.
Without accepting the Terms of Service, Torii's access will be limited.
Read and take action.
In case you choose to connect Google Workspace for Read and take actions, you will grant Torii the following permissions:
Integration Capabilities and Actions
You can stay updated about application information and actions from our Integrations Page >> Integration Capabilities button (1) >> Integration Capabilities table.
Torii pulls 2 types of usage events and calculates Google Workspace usage based on them:
SAML Audit activity events - Usage for apps connected to G-Suite SSO
Login Audit Activity Events - General usage for Google Workspace, for example, 2-step verification enrollment change, Account password change, etc.
On the first usage sync, Torii will pull activity events from the last 30 days.
You might encounter the following Authorization Error
- From Google Admin page go to Security
- API controls
- MANAGE THIRD-PARTY APP ACCESS
- Click on Add app
- Select the OAuth App Name OR Client ID option
- Search for Torii
Check all Client ID boxes
- Select the Trusted option