Google Workspace

Connect Google Workspace so the AI can act across Gmail, Calendar, Drive, and user accounts.

The Google Workspace integration gives Uniportal 80+ tools across Gmail, Calendar, Drive, and user account management. That covers the workflows that come up most: onboarding and offboarding a user, resetting a password, and handling Drive, mailbox, or calendar access requests, along with plenty of other day to day Workspace admin work.

You'll set this up separately for each customer running Google Workspace. It connects to one Workspace domain at a time, so unlike a PSA integration there's no single connect-and-map-companies step, each customer's Workspace tenant needs its own run through the setup wizard below.

How the connection works

Uniportal connects to Google Workspace through domain-wide delegation. The setup wizard creates a Google Cloud project inside the Workspace tenant with a service account authorized to act on behalf of Workspace users, scoped to exactly the Workspace APIs Uniportal uses.

That authorization has to be granted on the Google Workspace side directly, Google doesn't allow it to happen programmatically. So after the wizard sets up the project, an admin needs to add the delegation scopes by hand in the Workspace Admin console. That's the one manual step in an otherwise automated setup, covered below.

Prerequisites

Super Admin access to the Google Workspace tenant you're connecting. The wizard needs it to create the Google Cloud project and authorize domain-wide delegation.
Admin/Owner role in your Uniportal tenant.

Setup

Run the setup wizard

In the Uniportal dashboard, go to Integrations.
Select the Google Workspace tile.
Click Connect and follow the setup wizard, signed in as the Workspace tenant's Super Admin.

The wizard creates the Google Cloud project, the service account, and enables the required APIs for you. You shouldn't need to touch Google Cloud Console directly unless one of the issues below comes up.

Add the service account scopes in Google Workspace

On a first-time setup, the wizard creates a new OAuth client ID for this customer automatically, there's nothing to choose here. The Existing Client ID option is for reconnecting a customer that's had this integration before: if the client ID the wizard shows already exists in their Google Cloud project, use that one and just add whatever scopes are missing, instead of starting over.

Either way, the scopes below need to be authorized against that client ID in Google Workspace before the connection will work:

In the Google Workspace Admin console, go to Security > API Controls > Domain-wide Delegation.

Find the client ID and add these scopes:

openid
email
profile
https://www.googleapis.com/auth/admin.directory.customer.readonly
https://www.googleapis.com/auth/admin.directory.domain.readonly
https://www.googleapis.com/auth/admin.directory.user
https://www.googleapis.com/auth/admin.directory.group
https://www.googleapis.com/auth/admin.directory.group.member
https://www.googleapis.com/auth/admin.directory.orgunit
https://www.googleapis.com/auth/admin.directory.user.security
https://www.googleapis.com/auth/admin.directory.user.alias
https://www.googleapis.com/auth/admin.directory.userschema.readonly
https://www.googleapis.com/auth/admin.datatransfer
https://www.googleapis.com/auth/admin.reports.audit.readonly
https://www.googleapis.com/auth/apps.licensing
https://www.googleapis.com/auth/apps.groups.settings
https://www.googleapis.com/auth/admin.directory.resource.calendar
https://www.googleapis.com/auth/admin.directory.device.mobile
https://www.googleapis.com/auth/admin.directory.device.chromeos
https://www.googleapis.com/auth/gmail.settings.basic
https://www.googleapis.com/auth/gmail.settings.sharing
https://www.googleapis.com/auth/drive
https://www.googleapis.com/auth/calendar

The wizard also shows this same list, ready to copy, if you'd rather not retype it.

Back in the Uniportal wizard, click Verify.

Give it a few seconds

Google Workspace can take a moment to catch up after you save new scopes. If Verify fails right away, wait a few seconds and try again before assuming the scopes are wrong.

Control access to Google Workspace tools

Google Workspace tools show up on the Agent Tools page like any other integration's. Set a Mode on each one, Automated, Approval Required, or Disabled, and use custom roles if only some of your team should be able to use them. A password reset or an account change is a different level of trust than reading a calendar, so it's worth setting those separately.

Troubleshooting

Wizard can't create the Google Cloud project

If nobody has used Google Cloud Console under this Workspace tenant before, Google requires a one-time sign-in and terms acceptance before it will let anything, including the setup wizard, create a project. Sign in to console.cloud.google.com once as the Workspace Super Admin, accept the terms, then re-run the wizard.

Wizard can't create the service account key

New Google Cloud projects block applications from creating service account keys by default, under the organization policy constraints/iam.disableServiceAccountKeyCreation. Uniportal needs to create a key for the service account it sets up, so the wizard can't finish while that policy is on.

In Google Cloud Console, go to IAM & Admin > Organization Policies, find constraints/iam.disableServiceAccountKeyCreation, and disable it for the project. Then re-run the wizard.

Verification fails on a connection that used to work

Uniportal adds scopes here as new tools ship, and a client ID only has what was authorized against it at the time. If Verify starts failing on a customer that's been connected for a while, compare their client ID's scopes in the Workspace Admin console against the current list above and add whatever's missing.

On this page