Google Workspace

Prepare delegated accessCopy Anchor Link

Create a dedicated Google Cloud service account with domain-wide delegation. No project IAM role is needed for directory evidence. Enable the Admin SDK and Cloud Identity APIs.

Authorize the service account's client ID in Google Workspace with these OAuth scopes:

https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.orgunit.readonly
https://www.googleapis.com/auth/admin.reports.audit.readonly
https://www.googleapis.com/auth/cloud-identity.policies.readonly

Use a delegated super-administrator identity for the policy API. Store the service-account JSON key in Sparta's connection form and enter that delegated email address.

Verify coverageCopy Anchor Link

Run the connection check after delegation has propagated. Review directory users, administrator roles, groups, MFA information and accessible policy evidence.

Password and sharing-policy results depend on the configured, readable policy APIs. A directory-only connection does not establish those policies.

This evidence connection is separate from Google sign-in for Sparta users. Configuring one does not enable the other.

Connect evidence sources