> For the complete documentation index, see [llms.txt](https://docs.userlane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.userlane.com/administration/attributes/connect-an-attribute-source/google-workspace.md).

# Google Workspace

How to connect Google Workspace as an attribute source, including the permissions needed, setup steps, and the values to enter in Userlane.

This page walks through connecting Google Workspace so that Userlane can read employee information from your Google directory automatically. By the end, Google Workspace appears as a connected attribute source and your user data begins syncing.

This is the right first connector if your organization runs on Google rather than Microsoft. Because nearly everyone in a Google-based organization signs in through it, it usually reaches more people than any single human resources (HR) system or customer relationship management (CRM) system. It also asks for less than most: a client ID and a client secret, and nothing else.

{% hint style="warning" %}
**Prerequisites.** You need access to a Google Cloud project (or permission to create one) to register the application. A Google Workspace administrator whose role includes the **Users Read** privilege must authorize the connection. On the Userlane side, you need an **Admin**, **Portfolio Owner**, or **Deployment Manager** role. Before starting, ask your Userlane contact for the redirect address for Google Workspace.
{% endhint %}

## What Userlane reads from Google Workspace

Userlane matches Google Workspace against its standard set of attributes, the same set it uses for every source. See [Connect an attribute source](/administration/attributes/connect-an-attribute-source.md) for the full list.

Three things follow from that:

* Anything Google holds that is not in Userlane's set is dropped rather than stored, including any custom user schema fields.
* Anything in Userlane's set that Google does not hold, or does not fill in, stays empty.
* Attributes are applied to people who already exist in Userlane. Someone in your directory who has never used Userlane is ignored, not created.

Userlane only reads. It never creates, updates, or deletes users, groups, or organizational units.

{% hint style="info" %}
**This connector depends on data hygiene more than most.** Google Workspace tells you who works at your organization reliably, because everyone has an account. It is far less reliable on what they do: job title and department are optional free-text fields an administrator has to fill in. Check a few user profiles in the **Admin console** before connecting.
{% endhint %}

## Who you need

**To register the application:** someone with access to a Google Cloud project, or permission to create one.

**To authorize the connection:** a Google Workspace administrator whose role includes the **Users Read** privilege. A super administrator always has this. A delegated administrator[^1] can be given it without being made a super administrator.

{% hint style="warning" %}
**Check the scope of that administrator's role.** Google lets a delegated administrator's privileges be limited to specific organizational units. If the person who authorizes the connection only administers one part of the organization, Userlane receives only that part of the directory, with no error to indicate it. If you want the whole directory, the authorizing administrator's role has to cover the whole directory.
{% endhint %}

## Set up access in Google

Google splits this across two consoles: Google Cloud, where the application lives, and the Google **Admin console**, where directory access comes from.

{% stepper %}
{% step %}

#### Select or create a Google Cloud project

In Google Cloud, select an existing project or create one.
{% endstep %}

{% step %}

#### Enable the Admin SDK API

Enable the **Admin SDK API** for that project. Without it, the connection fails even though everything else looks correct.
{% endstep %}

{% step %}

#### Configure the consent screen

Set up the consent screen with an application name and a support email address.
{% endstep %}

{% step %}

#### Create an OAuth client

Create an OAuth 2.0 client[^2] of type **Web application**.
{% endstep %}

{% step %}

#### Add the redirect address

Add the authorized redirect address your Userlane contact gave you.
{% endstep %}

{% step %}

#### Copy the credentials

Copy the **Client ID** and **Client secret**.
{% endstep %}
{% endstepper %}

## Find the values Userlane asks for

| Userlane asks for | Where to find it                                |
| ----------------- | ----------------------------------------------- |
| **Client ID**     | On the OAuth client you created in Google Cloud |
| **Client secret** | On the same screen (copy it when it is shown)   |

Treat the client secret like a password. Where possible, have the person who created the OAuth client enter the values into Userlane themselves rather than passing the secret between people.

## Connect in Userlane

{% stepper %}
{% step %}

#### Open Attribute sources

In the portal, go to **Attribute sources** under company settings.
{% endstep %}

{% step %}

#### Select Google Workspace and enter the values

Select **Google Workspace** and enter the client ID and client secret.
{% endstep %}

{% step %}

#### Authorize with the right account

Sign in when prompted, **using the administrator account whose role covers the whole directory**, and approve the access Userlane requests.
{% endstep %}
{% endstepper %}

The authorization is tied to the account that completes it. If someone signs in with a personal or non-administrator account, the connection may succeed while returning only their own record.

Once connected, Google Workspace appears under connected sources. The first update usually arrives within about fifteen minutes, and Userlane then refreshes overnight once a day. For troubleshooting, see [Connect an attribute source](/administration/attributes/connect-an-attribute-source.md).

## Relevant articles

{% content-ref url="/pages/5RV9H7dUyIbkTHBrF8Av" %}
[Connect an attribute source](/administration/attributes/connect-an-attribute-source.md)
{% endcontent-ref %}

{% content-ref url="/pages/heUmxS6HxlGKqCQSjqbs" %}
[Attribute sources](/administration/attributes/attribute-sources.md)
{% endcontent-ref %}

{% content-ref url="/pages/eDKAypFN3hxD4iC2VJll" %}
[Attributes from SSO](/administration/attributes/attributes-from-sso.md)
{% endcontent-ref %}

{% content-ref url="/pages/b1SMRSBtvkd1sZZNi9U4" %}
[Salesforce](/administration/attributes/connect-an-attribute-source/salesforce.md)
{% endcontent-ref %}

## FAQ

<details>

<summary>Do I need a super administrator to connect?</summary>

Not necessarily. A delegated administrator with the **Users Read** privilege can authorize the connection. Make sure their role covers the whole directory if you want all users, not just one organizational unit.

</details>

<details>

<summary>Why are job titles and departments missing?</summary>

Google Workspace treats these as optional free-text fields. If your administrators have not filled them in, they arrive empty. The connector cannot create data that does not exist in the directory.

</details>

<details>

<summary>Does Userlane write anything back to Google Workspace?</summary>

No. The connection is read-only. Userlane never creates, updates, or deletes anything in your Google directory.

</details>

[^1]: A delegated administrator is a Google Workspace administrator with a custom role limited to specific privileges, rather than full super administrator rights.

[^2]: An OAuth client is the registered application record that lets Userlane request read access to your directory on your behalf.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.userlane.com/administration/attributes/connect-an-attribute-source/google-workspace.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.