> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-claude-google-workspace-docs-update-b925fd.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Set up a Google Workspace connector > C1 provides identity governance and just-in-time provisioning for Google Workspace. Integrate your Google Workspace instance with C1 to run user access reviews (UARs) and enable just-in-time access requests. **This is an updated and improved version of the Google Workspace integration!** If you're setting up a Google Workspace connector with C1 for the first time, you're in the right place. ## Capabilities | Resource | Sync | Provision | | :---------------------- | :------------------------------------------------------------ | :------------------------------------------------------------ | | Accounts | | | | Groups | | | | Roles | | | | Enterprise Applications | | | The Google Workspace connector supports [automatic account provisioning and deprovisioning](/product/admin/account-provisioning). ### Connector actions Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the [Perform connector action](/product/admin/automations-steps-reference#perform-connector-action) automation step. | Action name | Additional fields | Description | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | update\_user\_status | `resource_id` (string, required)
`is_suspended` (boolean, required) | Suspends or activates a user account | | disable\_user | `user_id` (string, required) | Suspends a user account (idempotent) | | enable\_user | `user_id` (string, required) | Unsuspends a user account (idempotent) | | change\_user\_primary\_email | `resource_id` (string, required)
`new_primary_email` (string, required) | Updates a user's primary email address | | transfer\_user\_drive\_files | `resource_id` (string, required)
`target_resource_id` (string, required)
`privacy_levels` (string, optional) | Transfers Google Drive ownership from one user to another. Accepts `private` or `shared` for privacy\_levels | | transfer\_user\_calendar | `resource_id` (string, required)
`target_resource_id` (string, required)
`release_resources` (boolean, optional) | Transfers Google Calendar data from one user to another | | change\_user\_org\_unit | `user_id` (string, required)
`org_unit_path` (string, required) | Moves a user to a different organizational unit | | offboarding\_profile\_update | `user_id` (string, required)
`archive_account` (boolean, optional) | Comprehensive offboarding: removes from GAL, clears recovery details, deletes addresses/phones, optionally archives | | sign\_out\_user | `user_id` (string, required) | Signs user out of all sessions and resets sign-in cookies | | delete\_all\_oauth\_tokens | `user_id` (string, required) | Revokes all third-party app authorizations | | delete\_all\_application\_passwords | `user_id` (string, required) | Deletes all app-specific passwords | | create\_group | `email` (string, required)
`name` (string, required)
`description` (string, optional) | Creates a new Google Workspace group | | modify\_group\_settings | `group_key` (string, required)
`allow_external_members` (boolean, optional)
`allow_web_posting` (boolean, optional)
`who_can_post_message` (string, optional)
`message_moderation_level` (string, optional) | Update settings for an existing Google Group | | update\_user\_manager | `user_id` (string, required)
`manager_email` (string, required) | Updates the manager relation for a user in Google Workspace. Updates the 'manager' entry in the user's Relations field | ## Before you begin This connector authenticates with a **service account and domain-wide delegation**, not per-user OAuth. Every call reaches Google as one service account impersonating a Workspace super admin. You need: * **Google Cloud console access** to a project where you can enable APIs and create a service account: project **Owner**, or **Editor** plus the ability to manage service accounts. * **Permission to create a service account key** (`iam.serviceAccountKeys.create`), granted by the **Service Account Key Admin** role (`roles/iam.serviceAccountKeyAdmin`). See [Allow service account key creation](#allow-service-account-key-creation). * **A Google Workspace super admin** to authorize domain-wide delegation and to act as the impersonated administrator. * Either the **Connector Administrator** or **Super Administrator** role in C1. **Check your organization's key policy first.** Google organizations created on or after May 3, 2024 block service account key creation by default. The connector requires a JSON key, so confirm you can create one before you start. See [Allow service account key creation](#allow-service-account-key-creation). ### What the Google Cloud project provides | What | Why it matters | | :------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Enabled APIs** | The connector calls the Admin SDK and Cloud Identity APIs, plus the Groups Settings API if you use group settings. Each must be enabled in your project. | | **Service account** | The single identity C1 authenticates as. It needs no project IAM role. | | **JSON key** | The credential you upload to C1. Creating one requires the Service Account Key Admin role and an organization policy that permits key creation. | | **Domain-wide delegation** | The Workspace-side grant that authorizes the service account's scopes. This is what actually lets the connector read and write directory data. | Domain-wide delegation is configured in the Google Admin console, not in Google Cloud. Granting the service account a Google Cloud IAM role does not give it access to Workspace data, and no project role is required for this connector. ## Set up the Google Cloud project This part happens entirely in Google Cloud and needs the Google Cloud permissions listed in [Before you begin](#before-you-begin). The Workspace super admin isn't needed until [Grant domain-wide delegation in Google Workspace](#grant-domain-wide-delegation-in-google-workspace). Each section below gives the Google Cloud console steps and the equivalent `gcloud` commands. Use whichever you prefer. To use the CLI, [install the gcloud CLI](https://cloud.google.com/sdk/docs/install) and run `gcloud auth login` first. ### Create or select a project Create a new Google Cloud project dedicated to this connector, or select an existing one. Sign in to [https://console.cloud.google.com](https://console.cloud.google.com/) with an account that can create projects, enable APIs, and manage service accounts. In the toolbar, open the project select dropdown and click **NEW PROJECT**. Create a new project for your organization: * **Project Name**: Choose a name, such as "C1 Integration" * **Organization/Location**: Choose the appropriate Organization/Location After the project is created, make sure the correct project is selected in the dropdown in the toolbar at the top of the page. From the command line: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud projects create YOUR_PROJECT_ID \ --name="C1 Integration" \ --organization=YOUR_ORG_ID ``` ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud config set project YOUR_PROJECT_ID ``` The Workspace APIs this connector uses don't require a billing account. ### Enable the APIs Enable the Admin SDK API, plus the Cloud Identity API and, if you use group settings, the Groups Settings API. | API | Service ID | Required? | Used for | | :------------------ | :------------------------------ | :-------- | :------------------------------------------------------------------------------------------------- | | Admin SDK API | `admin.googleapis.com` | Required | Syncing users, groups, roles, and audit events, and running provisioning and data transfer actions | | Cloud Identity API | `cloudidentity.googleapis.com` | Required | Resolving SAML app IDs to stable identifiers when syncing enterprise applications | | Groups Settings API | `groupssettings.googleapis.com` | Optional | The `modify_group_settings` connector action | The Admin SDK API covers the Directory, Reports, and Data Transfer APIs. Enabling it once is enough. There is no separate Data Transfer API to enable, even though the connector requests the `admin.datatransfer` scope. In the navigation menu, navigate to **APIs & Services** > **Library**. Search for and select the **Admin SDK API**, then click **Enable**. Repeat for the **Cloud Identity API**. **Optional.** If you want to use the group settings connector action, repeat for the **Groups Settings API**. From the command line: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud services enable \ admin.googleapis.com \ cloudidentity.googleapis.com \ groupssettings.googleapis.com \ --project=YOUR_PROJECT_ID ``` To confirm which APIs are enabled on the project: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud services list --enabled --project=YOUR_PROJECT_ID ``` ### Create a service account Create the service account C1 will authenticate as. In the navigation menu, navigate to **APIs & Services** > **Credentials**. Select **CREATE CREDENTIALS** > **Service Account**. Under **Service account details**, fill in the following: * **Service account name:** C1 Integration * **Service account description:** for example, "Service account for C1 Google Workspace Integration" * Click **CREATE AND CONTINUE** Under **Grant this service account access to a project**, click **CONTINUE** without selecting a role. The connector's access comes from domain-wide delegation, so no project role is required. Leave **Grant users access to this service account** blank. Click **DONE**. From the command line: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud iam service-accounts create c1-integration \ --project=YOUR_PROJECT_ID \ --display-name="C1 Integration" \ --description="Service account for C1 Google Workspace Integration" ``` Earlier versions of this guide granted the service account the **Editor** role. That role is not needed and grants broad access to your Google Cloud project. If you already granted it, you can safely remove it. ### Allow service account key creation The connector authenticates with a JSON key, so your organization must permit key creation on this service account. The `constraints/iam.disableServiceAccountKeyCreation` organization policy blocks key creation. **Google enforces this policy by default for organizations created on or after May 3, 2024**, so new organizations hit it unless an administrator grants an exception. If the policy blocks you, key creation fails with: ```text theme={"theme":{"light":"css-variables","dark":"css-variables"}} ERROR: (gcloud.iam.service-accounts.keys.create) FAILED_PRECONDITION: Key creation is not allowed on this service account. ``` In the console, the **ADD KEY** option is unavailable and Google reports that service account key creation is disabled. **Permissions to check:** | Requirement | Details | | :------------------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | IAM permission | `iam.serviceAccountKeys.create`, granted by the **Service Account Key Admin** role (`roles/iam.serviceAccountKeyAdmin`). The basic **Editor** role also includes it. | | Organization policy | `constraints/iam.disableServiceAccountKeyCreation` must not be enforced on the project. A managed equivalent, `iam.managed.disableServiceAccountKeyCreation`, controls the same behavior. | | Related policies | `constraints/iam.serviceAccountKeyExpiryHours` caps how long new keys stay valid. If your organization sets it, plan to rotate the key in C1 before it expires. | Grant the key admin role to whoever creates the key: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud iam service-accounts add-iam-policy-binding \ c1-integration@YOUR_PROJECT_ID.iam.gserviceaccount.com \ --member="user:admin@yourdomain.com" \ --role="roles/iam.serviceAccountKeyAdmin" \ --project=YOUR_PROJECT_ID ``` Check whether the organization policy is enforced on your project: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud org-policies describe iam.disableServiceAccountKeyCreation \ --project=YOUR_PROJECT_ID \ --effective ``` If it is enforced, a user with the **Organization Policy Administrator** role (`roles/orgpolicy.policyAdmin`) can add a project-level exception. Save this as `policy.yaml`: ```yaml theme={"theme":{"light":"css-variables","dark":"css-variables"}} name: projects/YOUR_PROJECT_ID/policies/iam.disableServiceAccountKeyCreation spec: rules: - enforce: false ``` Then apply it: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud org-policies set-policy policy.yaml ``` This exception applies only to the project you name. Enforcement elsewhere in your organization is unchanged. If your organization manages exceptions with tags rather than per-project policies, see Google's [Organization policies and tags](https://cloud.google.com/resource-manager/docs/organization-policy/tags-organization-policy) documentation. Google recommends against long-lived service account keys and prefers Workload Identity Federation where it's available. This connector requires a JSON key, so treat it as a sensitive credential: store it in a secrets manager, never commit it to source control, and rotate it on a schedule. See Google's [best practices for managing service account keys](https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys). ### Create the key and get the unique ID Generate the service account's JSON key and record its numeric unique ID, which domain-wide delegation requires. Navigate back to **APIs & Services** > **Credentials** and select the service account you just created. Click the service account's email address. Locate and save the **Unique ID**, a numeric string such as `108123456789012345678`. The service account's details page also shows this value as the **OAuth 2 Client ID**. Do not confuse the Unique ID with the service account's email address. Domain-wide delegation requires the numeric ID. On the **Service account details** page, click **KEYS**. Click **ADD KEY** > **Create new key**. Choose **JSON** and click **CREATE**. Keep the downloaded file somewhere safe. Google does not let you download it again. From the command line: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud iam service-accounts keys create c1-credentials.json \ --iam-account=c1-integration@YOUR_PROJECT_ID.iam.gserviceaccount.com ``` Retrieve the numeric unique ID you'll use for domain-wide delegation: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud iam service-accounts describe \ c1-integration@YOUR_PROJECT_ID.iam.gserviceaccount.com \ --format='value(uniqueId)' ``` To review the keys that exist on the service account: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud iam service-accounts keys list \ --iam-account=c1-integration@YOUR_PROJECT_ID.iam.gserviceaccount.com ``` ## Grant domain-wide delegation in Google Workspace Domain-wide delegation authorizes the service account to call Workspace APIs on behalf of your organization. Configure it in the Google Admin console. Go to [https://admin.google.com](https://admin.google.com) as a **SUPER ADMIN**. In the navigation menu, select **Security** > **Access and data control** > **API Controls**. Click **MANAGE DOMAIN WIDE DELEGATION**. Click **Add new** and fill out the form: * **Client ID**: The service account's Unique ID * **OAuth Scopes**: Copy and paste in the relevant scopes from [OAuth scopes](#oauth-scopes) below Click **AUTHORIZE**. ### OAuth scopes Choose one of the two sets below. Read-only access lets C1 sync access data. Read/write access lets C1 sync access data and provision access. Paste this comma-separated list into the **OAuth Scopes** field: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.group.member.readonly, https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly, https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.reports.audit.readonly, https://www.googleapis.com/auth/admin.directory.user.security, https://www.googleapis.com/auth/cloud-identity.inboundsso.readonly ``` | Scope | Purpose | | :---------------------------------------- | :-------------------------------------------------------------------------------------------------------- | | `admin.directory.domain.readonly` | Identify the primary domain of the Google Workspace account | | `admin.directory.group.readonly` | Read and sync Google Groups | | `admin.directory.group.member.readonly` | Read and sync the members of each group | | `admin.directory.rolemanagement.readonly` | Read and sync roles and their assignments | | `admin.directory.user.readonly` | Read and sync users | | `admin.reports.audit.readonly` | Sync usage events and admin events, used with incremental sync | | `admin.directory.user.security` | Discover OAuth apps through per-user token listing | | `cloud-identity.inboundsso.readonly` | Optional. Resolve SAML app IDs to stable identifiers. Without it, SAML app IDs fall back to display names | Paste this comma-separated list into the **OAuth Scopes** field: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} https://www.googleapis.com/auth/admin.directory.domain.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.group.member, https://www.googleapis.com/auth/admin.directory.rolemanagement, https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/admin.reports.audit.readonly, https://www.googleapis.com/auth/admin.datatransfer, https://www.googleapis.com/auth/admin.directory.group, https://www.googleapis.com/auth/admin.directory.user.security, https://www.googleapis.com/auth/apps.groups.settings, https://www.googleapis.com/auth/cloud-identity.inboundsso.readonly ``` | Scope | Purpose | | :----------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------- | | `admin.directory.domain.readonly` | Identify the primary domain of the Google Workspace account | | `admin.directory.group.readonly` | Read and sync Google Groups | | `admin.directory.group.member` | Write. Manage group memberships, adding or removing users from groups | | `admin.directory.rolemanagement` | Write. Manage role assignments, granting or revoking roles | | `admin.directory.user` | Write. Provision and deprovision accounts | | `admin.reports.audit.readonly` | Sync usage events and admin events, used with continuous sync | | `admin.datatransfer` | Write. Transfer user data between Google accounts | | `admin.directory.group` | Write. Provision groups | | `admin.directory.user.security` | Write. Discover OAuth apps and run actions that remove a user's access, such as sign out and deleting auth tokens and app passwords | | `apps.groups.settings` | Write. Edit group settings. Requires the Groups Settings API | | `cloud-identity.inboundsso.readonly` | Optional. Resolve SAML app IDs to stable identifiers. Without it, SAML app IDs fall back to display names | The write scopes let C1 provision and deprovision access. **If you don't want C1 to perform these tasks, use the read-only scope set.** Read-only still syncs users, groups, and roles, so it's sufficient when you use Google Workspace as your [directory](#set-google-workspace-as-your-c1-directory) and run access reviews. ### Find your customer ID and primary domain The connector configuration needs your Google Workspace customer ID and primary domain, both available in the Admin console. In the Google Admin console, select **Account** > **Account Settings**. Copy the **Customer ID** from this page. In the navigation panel on the left, click **Account** > **Domains**. Click **Manage Domains**. Locate and copy the domain labeled as the **Primary Domain** in the **Type** column. **Done.** Next, move on to the connector configuration instructions. ## Configure the Google Workspace connector This task requires either the **Connector Administrator** or **Super Administrator** role in C1. **Follow these instructions to use a built-in, no-code connector hosted by C1.** In C1, navigate to **Integrations** > **Connectors** and click **Add connector**. Search for **Google Workspace v2** and click **Add**. Choose how to set up the new Google Workspace connector: * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1) * Add the connector to a managed app (select from the list of existing managed apps) * Create a new managed app Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed. Click **Next**. * **If you are the connector owner**, go on to the next step. * **If someone else is the connector owner**, you can stop here. C1 will notify the connector owner by email that their help is needed to complete the setup process. Find the **Settings** area of the page and click **Edit**. In the **Customer ID** field, enter the Google Workspace customer ID. **Optional.** If you want to limit which domains C1 syncs, in the **Domain** field, enter your primary domain. If you leave this field blank, C1 will sync all available domains. In the **Administrator email** field, enter the email address of a Google Workspace super admin. The service account impersonates this user. In the **Credentials (JSON)** area, click **Choose file** and upload the file. Click **Save**. The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing. **Done.** Your Google Workspace connector is now pulling access data into C1. **Follow these instructions to use the Google Workspace connector, hosted and run in your own environment.** When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests. ### Resources * [Official download center](https://dist.conductorone.com/ConductorOne/baton-google-workspace): For stable binaries (Windows/Linux/macOS) and container images. * [GitHub repository](https://github.com/conductorone/baton-google-workspace): Access the source code, report issues, or contribute to the project. ### Step 1: Set up a new Google Workspace connector In C1, navigate to **Integrations** **Connectors** > **Add connector** Search for **Baton** and click **Add** Choose whether to add to an existing application or create new Set the connector owner(s) Click **Create and add details** In the **Settings** area, click **Edit** Click **Rotate** to generate a new Client ID and Secret Save these credentials securely - you'll need them for the Kubernetes configuration ### Step 2: Create Kubernetes configuration files Create two Kubernetes manifest files for your Google Workspace connector deployment: #### Secrets configuration ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}} # baton-google-workspace-secrets.yaml apiVersion: v1 kind: Secret metadata: name: baton-google-workspace-secrets type: Opaque data: # C1 credentials BATON_CLIENT_ID: BATON_CLIENT_SECRET: # Google Workspace specific credentials BATON_CUSTOMER_ID: BATON_DOMAIN: BATON_ADMINISTRATOR_EMAIL: BATON_CREDENTIALS_JSON: # Optional: include if you want C1 to provision access using this connector BATON_PROVISIONING: true ``` **Base64 Encoding:** Use `echo -n "your-value" | base64` to encode your secrets, See the connector's README or run `--help` to see all available configuration flags and environment variables. #### Deployment configuration ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}} # baton-google-workspace.yaml apiVersion: apps/v1 kind: Deployment metadata: name: baton-google-workspace labels: app: baton-google-workspace spec: selector: matchLabels: app: baton-google-workspace template: metadata: labels: app: baton-google-workspace baton: true baton-app: google-workspace spec: containers: - name: baton-google-workspace image: public.ecr.aws/conductorone/baton-google-workspace:latest imagePullPolicy: IfNotPresent env: - name: BATON_HOST_ID value: baton-google-workspace envFrom: - secretRef: name: baton-google-workspace-secrets ``` ### Step 3: Deploy the connector Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files. Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Google Workspace connector to. Google Workspace data should be found on the **Entitlements** and **Accounts** tabs. **Done.** Your Google Workspace connector is now pulling access data into C1. ## Set Google Workspace as your C1 directory If Google Workspace is your source of truth for who works at your company, designate the connector's app as your [directory](/product/admin/directory). C1 then creates a C1 user for each Workspace account it syncs, and accounts from your other connectors attach to those users. Importing users and groups doesn't require provisioning. If all you want is a directory and access reviews, the read-only scope set in [OAuth scopes](#oauth-scopes) is sufficient, and the service account still needs no Google Cloud IAM role. Wait for the connector's first sync to finish. An app becomes available to select only after it has synced at least once. In C1, navigate to **Directory** > **Directory sources**. On the **Directories** tab, click **Add directory data source**. Select the app your Google Workspace connector is attached to. **Optional.** [Limit which accounts will be pulled into C1](/product/admin/directory#optional-limit-which-accounts-will-be-pulled-into-c1) or [configure merge matching](/product/admin/directory#configure-merge-matching). You can change both later. Click **Create directory**. For how directory accounts become C1 users, and how accounts from non-directory apps find an owner, see [Connect a directory](/product/admin/directory). ## What's next? If Google Workspace is your company's identity provider (meaning that it is used to SSO into other software), the integration sync will automatically create applications in C1 for all of your SCIMed software. Before you move on, review the [Create applications](/product/admin/applications) page for important information about how to set up integrations with the SCIMed apps. ## Troubleshooting the Google Workspace integration | Symptom | Cause | Fix | | :---------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `FAILED_PRECONDITION: Key creation is not allowed on this service account` | The `iam.disableServiceAccountKeyCreation` organization policy is enforced, or you lack the Service Account Key Admin role. | See [Allow service account key creation](#allow-service-account-key-creation). | | `Error 403: Request had insufficient authentication scopes` / `ACCESS_TOKEN_SCOPE_INSUFFICIENT` | The domain-wide delegation grant is missing scopes the connector needs. | Remove and re-add the API client with the full scope set. See [When adding permissions to my Google Workspace API Client permissions I get authorization errors](#when-adding-permissions-to-my-google-workspace-api-client-permissions-i-get-authorization-errors). | | `unauthorized_client` when the connector authenticates | The Client ID in domain-wide delegation doesn't match the service account's Unique ID, or the requested scopes aren't authorized. | Confirm you entered the numeric **Unique ID**, not the service account email, and that the scope list matches exactly. | | `SERVICE_DISABLED` or "API has not been used in project ... before or it is disabled" | The connector's API isn't enabled in the project. | Enable it. See [Enable the APIs](#enable-the-apis). | | Authentication succeeds but the sync returns no users or `Not Authorized to access this resource/api` | The **Administrator email** isn't a super admin, or the **Customer ID** is wrong. | Confirm both values. See [Find your customer ID and primary domain](#find-your-customer-id-and-primary-domain). | | The connector worked and then stopped authenticating | The service account key expired under `constraints/iam.serviceAccountKeyExpiryHours`, or someone deleted it. | Create a new key and upload it to the connector. | ### When adding permissions to my Google Workspace API Client permissions I get authorization errors **Example error:** `error using connector deprovision [attempt #3]: error: delete resource failed: googleapi: Error 403: Request had insufficient authentication scopes. Details: [ { "@type": "type.googleapis.com/google.rpc.ErrorInfo", "domain": "googleapis.com", "metadata": { "method": "ccc.hosted.frontend.directory.v1.DirectoryUsers.Update", "service": "admin.googleapis.com" }, "reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT" } ] More details: Reason: insufficientPermissions, Message: Insufficient Permission` **To resolve this issue:** Remove the Google Workspace API Client, then re-add with the correct permissions. Copy the Client ID. Delete the API Client. Add a new Client ID. Re-add the relevant scopes from [OAuth scopes](#oauth-scopes).