> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace

> Connect Google Workspace to Myrmex — review directory, users, and security posture on demand.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect your **Google Workspace** so Myrmex can review your directory — users, groups, org units, admin roles, and security settings — and audit your posture. Myrmex connects from the cloud using a Google **service account with domain-wide delegation**, reading in real time, on demand — nothing from your Workspace is stored on the Myrmex side.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Directory visibility" icon="users">
    Review users, groups, org units, and admin roles across your organization.
  </Card>

  <Card title="Security posture" icon="shield-halved">
    Audit 2-step verification coverage, admin practices, and sharing settings.
  </Card>

  <Card title="Access review" icon="user-shield">
    Spot over-privileged admins and stale or risky accounts.
  </Card>

  <Card title="Investigate" icon="magnifying-glass">
    Ask about your Workspace directory and settings directly in the Workspace.
  </Card>
</CardGroup>

## Before You Start

Google Workspace connects from the cloud — **no Collector is required**. You'll need:

* A **Google Cloud project** where you can enable APIs and create a service account.
* **Super Admin** access to the Google Workspace **Admin console**, to authorize domain-wide delegation.
* A **Workspace admin email** for the service account to impersonate.

## Step 1 — Create the Credential in Google

<Steps>
  <Step title="Enable the Admin SDK API">
    In your Google Cloud project, enable the **Admin SDK API**.
  </Step>

  <Step title="Create a service account">
    In **IAM & Admin → Service Accounts**, create a service account **without any roles**, then add a key of type **JSON** and download it.
  </Step>

  <Step title="Note the unique ID">
    Copy the service account's **unique ID** (client ID) — you'll need it for delegation.
  </Step>

  <Step title="Authorize domain-wide delegation">
    In the Workspace **Admin console → Security → API controls → Domain-wide delegation**, add the service account's client ID with the read-only **Admin SDK** OAuth scopes.
  </Step>
</Steps>

<Tip>
  Grant only read-only Admin SDK scopes during delegation — that's all Myrmex needs to review your directory and posture.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Google Workspace**, then fill in:

| Field                         | Description                                                                                                                          |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| **Enable Admin SDK API**      | Confirms the Admin SDK API is enabled in your Google Cloud project.                                                                  |
| **Service Account JSON**      | The full contents of the JSON key from the service account you created (without roles). Stored securely and never exposed to the AI. |
| **Service Account Unique ID** | The service account's unique client ID, used for domain-wide delegation.                                                             |
| **Valid Email**               | A Workspace admin email address for the service account to impersonate.                                                              |

## Connect

Click **Connect** to validate the credential and finish. Google Workspace then appears under **Environment → Integrations**, and you can start asking the AI about it in the Workspace.

<Note>
  The service account itself holds no roles — its access comes entirely from the read-only scopes you authorize in the Admin console, and it acts as the admin email you specify.
</Note>