Google Workspace

What it covers

2-Step Verification enforcement and super-admin count.

Credential to create

Google Cloud service account with domain-wide delegation (not a raw access token)

Create a service account (Google Cloud)

Authorize delegation (Workspace Admin)

Permissions to grant

• https://www.googleapis.com/auth/admin.directory.user.readonly

Setup steps

1. In Google Cloud (IAM & Admin > Service Accounts), create a service account. It needs NO project role - Workspace access is granted by delegation later, not by a GCP IAM role. Then open it, go to Keys > Add key > JSON, and download the key file.
2. Still in Google Cloud (APIs & Services > Library), search for 'Admin SDK API' and Enable it for the project - without this the directory calls are rejected.
3. Get the service account's client ID: it is the long 'Unique ID' / 'OAuth 2 Client ID' number on the service account's details, or the client_id field in the JSON - paste the JSON into the helper above to pull it out.
4. In the Workspace Admin console (the 'Authorize delegation' button below opens it directly: Security > Access and data control > API controls > Domain-wide delegation), click 'Add new', paste the client ID, and authorize the scope https://www.googleapis.com/auth/admin.directory.user.readonly. There is no domain-wide-delegation toggle in Google Cloud anymore - this Admin-console authorization IS the delegation.
5. In Joopler, paste the service account key JSON and enter a super-admin email to impersonate, then save and click Test connection. Joopler mints and refreshes the Admin SDK token itself.

Notes and gotchas

• No GCP IAM role is required on the service account. Reading Workspace directory data works entirely through the domain-wide-delegation authorization in the Admin console - granting a project role does nothing for it.
• You must Enable the 'Admin SDK API' in the Cloud project, or every call fails with an access/API-disabled error. This is the most commonly missed step.
• The impersonated subject must be a Google Workspace admin to read the 2-step-verification and admin fields.
• The gws-audit-log-accessible control checks the Admin Reports API. It needs the scope https://www.googleapis.com/auth/admin.reports.audit.readonly available to the credential; until that scope is granted the check reports ERROR (a prompt to grant it), not a failure.
• The durable path is the service account JSON + an impersonation subject. You can instead paste a raw ya29 access token, but it expires in about an hour, so scheduled runs would stop.
• If key creation is blocked ('Service account key creation is disabled', org policy iam.disableServiceAccountKeyCreation): an Organization Policy Admin can allow it on just the one project (add a project-scoped exception to that constraint), create the key, then re-lock - or, for a quick test only, paste a short-lived OAuth access token instead. A fully keyless OAuth connect is on our roadmap.