User Risk: Create a Google Workspace service account

• Overview
• Step 1: Create a user for the integration
• Step 2: Assign the Super admin role or use a custom role instead

• Step 3: Assign the role to the user

• Step 4: Connect User Risk to your directory

• What User Risk collects

Overview

User Risk reads your users and their SaaS usage from Google Workspace through the Google Workspace APIs. You grant access through Google's standard OAuth consent screen, using an account that holds the permissions below. 

Setup workflow:

• Create a Google Workspace user for the integration.
• Give that user access; either the Super admin role, or a custom role.
• Connect the account to User Risk in UpGuard.

Step 1: Create a user for the integration

Create the account at the highest organizational unit that covers the users you want to see in User Risk.

1. Log in to the Google Admin console.
2. Navigate to Directory > Users.
3. Click Add a New User.
4. Fill in the user information.
5. Click Add New User.

The account exists but has no permissions yet. Grant them using either Step 2 or Step 3.

Step 2: Assign the Super admin role or use a custom role instead

The Super admin role gives User Risk visibility of every user in your directory. Use this step unless your organization doesn't want the integration account holding Super admin. If this is the case, you'll need to use a custom role instead.

Assign the Super admin role

1. In the Google Admin console, navigate to Directory > Users and open the user you created.
2. Click Assign Roles under Admin roles and privileges.
3. Toggle on the Super admin role.

The account can now scan every user in your directory. Skip the custom role steps and go to Step 3.

Use a custom role instead

Use these steps only if you did not assign the Super admin role.

Create the custom role

1. In the Google Admin console, navigate to Account > Admin roles.
2. Click Create a New Role.
3. Fill in the role details and click Continue.
4. On the Select privileges screen, scroll down to Admin API privileges.
5. Select the following privileges:
   • User security management
   • Organisation units > Read
   • Users > Read
6. Click Continue.
7. Check that the right permissions are selected, then click Create Role.

Assign the custom role to the user

1. Select the custom role you created.
2. Click Assign members.
3. Search for and select the user you created.
4. Click Assign role.

The account now has the permissions User Risk needs.

To limit which users User Risk scans, create a role assignment for each organizational unit that contains users you want scanned. If your organizational units are nested, create an assignment for the parent unit and one for each child. Google only allows a single assignment at the top organizational unit.

Step 3: Connect User Risk to your directory

1. Click the Settings (gear) icon in UpGuard's upper right-hand corner.
2. Click Directory Integration under User Risk in the left-hand navigation panel.

3. In the Google Workspace integration section, click Integrate via OAuth.

4. Sign in with the account you created and grant the requested permissions on Google's OAuth consent screen.

Your directory is now connected. The Directory Integration screen shows a Start Scan button and the date your directory was last scanned.

What User Risk collects

User Risk reads the following for each user in your directory:

• name
• email
• role
• team

It also reads SaaS usage information from your workspace. This is similar to the view an individual user sees on their own Google account connections page.

User Risk calls the Google Workspace API to list your organization's users and their associated SaaS usage. It can only do this while the integration is connected and the account has the permissions above.

The integration account grants User Risk these two Google Workspace API scopes:

• https://www.googleapis.com/auth/admin.directory.user.readonly
• https://www.googleapis.com/auth/admin.directory.user.security