Data Integration Guide - Google Workspace

The Google Workspace integration enables Living Security Unify to ingest user identity and activity data directly from Google Workspace. It provides centralized visibility into human risk by combining login behavior, MFA adoption, and document access patterns.

Using the Google Admin SDK Directory and Reports APIs, this integration synchronizes user metadata and event activity for risk modeling, identity correlation, and anomaly detection.

Support Streams

Configuration

Prerequisites

• Google Workspace Admin Access (Super Admin role)
• Access to Google Cloud Console
• APIs enabled in GCP project:
  • Admin SDK API
  • Directory API v1
  • Reports API v1

Step 1: Create a Service Account

1. Go to Google Cloud Console.
2. Select or create a project.
3. Navigate to IAM & Admin → Service Accounts → Create Service Account.
4. Provide a name (e.g., “Unify Integration Service Account”).
5. Click Create and Continue, then Done.

Step 2: Generate a Service Account Key

1. Open the new service account.
2. Go to the Keys tab → Add Key → Create new key.
3. Choose JSON format and download the file.
4. Store this file securely—it will be used for authentication.

Step 3: Enable Domain-Wide Delegation

1. In the service account details, click Show Advanced Settings.
2. Enable Google Workspace Domain-Wide Delegation.

3. Note the Client ID for authorization.

Step 4: Authorize API Scopes in Workspace Admin Console

1. Open Google Admin Console.
2. Navigate to Security → Access and data control → API controls.
3. Under Domain-wide delegation, click Manage Domain-Wide Delegation → Add new.
4. Enter your Client ID and authorize the following scopes:
   1. https://www.googleapis.com/auth/admin.directory.user
   2. https://www.googleapis.com/auth/admin.directory.group
   3. https://www.googleapis.com/auth/admin.directory.orgunit
   4. https://www.googleapis.com/auth/admin.directory.domain
   5. https://www.googleapis.com/auth/admin.directory.rolemanagement
   6. https://www.googleapis.com/auth/admin.reports.audit.readonly (Required only for the Reports stream)

Step 5: Configure the Integration in Unify

1. In Unify, navigate to Integrations → Google Workspace.
2. Paste the Service Account JSON file contents into the credentials field.
3. Provide an Admin Email (e.g. admin@customerdomain.com) with Super Admin privileges.
4. Enter the required scopes in the Scopes field in one of the following formats:
   1. JSON array string: ["scope1", "scope2"]
   2. Comma-separated: scope1,scope2
   3. Single scope: scope1

Step 6: Verify Stream Configuration

• Users Stream: Syncs identity and profile data.
• Reports Stream: Ingests activity and login data.
• Confirm desired applications (e.g., login, drive, admin) are selected in Unify's stream configuration panel.

Step 7: Test and Validate

1. Trigger a manual sync from Unify.
2. Confirm activity events appear under the Unify Activity Logs.
3. Verify timestamps and user mappings match expected Workspace data.

Activity Types Emitted by Stream