Skip to main content
The Google Workspace integration pulls user and organizational unit data from your Workspace domain into Regentra. This data is used to evidence access reviews and provisioning controls.

​
What it provides

  • User sync — Active and suspended users, org units, primary email, and last sign-in
  • Access review evidence — Used to evidence access reviews and provisioning controls
  • Read-only access — Regentra cannot create, modify, or suspend Workspace users

​
Setup

1

Create a service account in Google Cloud Console

In Google Cloud Console, create or pick a project, then create a service account. Note the service account’s Client ID (the long numeric one, not the email).
2

Enable the Admin SDK API

Enable the Admin SDK API on the project.
3

Create and download a JSON key

Create a JSON key for the service account and download the file. Paste the full JSON contents into the Service Account JSON field on the Workspace card in Regentra.
4

Enable domain-wide delegation

In the Google Workspace Admin Console, open Security → API Controls → Domain-wide Delegation. Click Add new and enter the service account’s Client ID.
5

Add the OAuth scope

Add this OAuth scope to the delegation:
https://www.googleapis.com/auth/admin.directory.user.readonly
6

Set the admin email

In the Admin Email (for delegation) field on the Regentra card, enter the email of a Workspace super-admin that the service account will impersonate when querying the Directory API.
7

Save and test

Save and test the connection.

​
Sync frequency

  • Automatic sync runs every 4 hours on the hour
  • Manual sync can be triggered at any time from the integration card
Manual and scheduled syncs are serialized per organization so a Sync Now during a scheduled run waits for it to finish.

​
Troubleshooting

Domain-wide delegation isn’t wired up. The Client ID you added in the Admin Console must EXACTLY match the service account’s numeric Client ID, and the requested scope must be on the allow-list. Re-check both.
The Admin Email is missing or isn’t a real Workspace super-admin in the same domain. Service-account delegation needs an admin to impersonate; pick one (any super-admin works) and re-save.
Google Cloud → IAM & Admin → Service Accounts → Keys. Generate a new key, paste it into Regentra, then delete the old key from Google. Regentra picks up the new key on the next sync.