Skip to main content
Connect your Google Workspace so Myrmex can review your directory — users, groups, org units, admin roles, and security settings — and audit your posture. Myrmex connects from the cloud using a Google service account with domain-wide delegation, reading in real time, on demand — nothing from your Workspace is stored on the Myrmex side.

​
What Myrmex Can Do

Directory visibility

Review users, groups, org units, and admin roles across your organization.

Security posture

Audit 2-step verification coverage, admin practices, and sharing settings.

Access review

Spot over-privileged admins and stale or risky accounts.

Investigate

Ask about your Workspace directory and settings directly in the Workspace.

​
Before You Start

Google Workspace connects from the cloud — no Collector is required. You’ll need:
  • A Google Cloud project where you can enable APIs and create a service account.
  • Super Admin access to the Google Workspace Admin console, to authorize domain-wide delegation.
  • A Workspace admin email for the service account to impersonate.

​
Step 1 — Create the Credential in Google

1

Enable the Admin SDK API

In your Google Cloud project, enable the Admin SDK API.
2

Create a service account

In IAM & Admin → Service Accounts, create a service account without any roles, then add a key of type JSON and download it.
3

Note the unique ID

Copy the service account’s unique ID (client ID) — you’ll need it for delegation.
4

Authorize domain-wide delegation

In the Workspace Admin console → Security → API controls → Domain-wide delegation, add the service account’s client ID with the read-only Admin SDK OAuth scopes.
Grant only read-only Admin SDK scopes during delegation — that’s all Myrmex needs to review your directory and posture.

​
Step 2 — Add the Integration in Myrmex

From the Directory, choose Add Integration → Google Workspace, then fill in:

​
Connect

Click Connect to validate the credential and finish. Google Workspace then appears under Environment → Integrations, and you can start asking the AI about it in the Workspace.
The service account itself holds no roles — its access comes entirely from the read-only scopes you authorize in the Admin console, and it acts as the admin email you specify.