Google Workspace

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Google Workspace using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules. Compliance checks re-run once a day at 02:00 America/New_York.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Google Workspace environment.

What DSALTA reads

DSALTA reads the Google Workspace user roster — names, emails, roles and active status, which appears on your Access page.It calls these Google Workspace endpoints, on the Admin SDK Directory API (https://admin.googleapis.com/admin/directory/v1):

/users
/users/{userEmail}
/groups
/groups/{groupId}/members

It also calls Google’s OAuth endpoints to obtain and inspect the access token: https://oauth2.googleapis.com/token and https://www.googleapis.com/oauth2/v1/tokeninfo.Scopes DSALTA requests: openid, email, profile, https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly — these five are what appears on the consent screen.Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Google Workspace environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Google Workspace card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Google Workspace. This usually happens when API tokens expire.

Data is not syncing

Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.

DSALTA requests these scopes: openid, email, profile, https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly.Sign in with Google as a Workspace Super Admin and grant read-only Admin SDK access to your users and groups. Choose your administrator account when Google prompts you — no domain or other fields are needed.Before you begin

a Google Workspace Super Admin (or an admin with Users & Groups read access)

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Google Workspace, and click Connect to open the connect panel.

DSALTA requests read-only Admin SDK access to your Google Workspace users and groups — it never changes anything in your directory. On the next screen, click Sign in with Google and approve access with a Super Admin account. You will return here automatically once the connection is saved; no domain field is required.Sign in with an admin whose account lives in the domain you want reviewed. DSALTA scopes the user and group listing to the primary domain of the account that authorized the connection (it reads that from Google’s tokeninfo endpoint). On a tenant with several domains, that means you get one domain’s roster — not every user in the customer account.

Two of the listed checks are manual-evidence placeholders. Each run lands as a green Passing result whose message is the check’s own summary telling you to verify the value by hand, and the Source Data tab stamps that run with status code 204. A 204 run carries no evaluation, so collect the evidence yourself. Password policy should meet minimum requirements — Google’s Admin SDK does not expose the organization password policy for programmatic read; record it manually from Admin console → Security → Authentication → Password management. Vendor discovery should be configured — this connection is granted directory read only; review third-party OAuth access manually under Admin console → Reporting → Audit log → Token.

DSALTA asks Google for exactly five scopes and nothing else: openid, email, profile, admin.directory.user.readonly and admin.directory.group.readonly. Every one is read-only, and the two directory scopes are what the consent screen will name. If your organization reviews granted third-party access in the Admin console, this is the complete list you should expect to see.

If the connection is rejected, or the first sync fails. The Directory API calls behind these scopes require an admin, so sign in with a Super Admin — or an admin role carrying Users and Groups read. If a sync stopped with a permission error naming Directory API users.list, disconnect, sign in again with that account, and compare the on-screen message with Connection error messages.

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Select a check for step-by-step remediation guidance. Two of the six always report not applicable: Password policy should meet minimum requirements and Vendor discovery should be configured. Record both as manual evidence.

Check	Severity	What it verifies
MFA should be enabled for all users	Info	Checks that MFA is enabled for all Google Workspace users.
User access to Critical System should be valid	Info	Checks that everyone with Google Workspace access is an active employee on the People page.
Offboarded users should not have active access	High	Checks that offboarded employees no longer have active Google Workspace access.
Admin accounts should have MFA enabled	Info	Checks that all Google Workspace admin accounts have MFA enabled.
Password policy should meet minimum requirements	Info	Checks that the Google Workspace password policy meets minimum security requirements.
Vendor discovery should be configured	Info	Checks that vendor discovery is configured in Google Workspace.

Topic	Link
Setup	Google Workspace Admin SDK
General	Google Workspace website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting