Google Workspace - Add Users
  • 19 Sep 2024
  • 4 Minutes to read
  • Dark
    Light
  • PDF

Google Workspace - Add Users

  • Dark
    Light
  • PDF

Article summary

Google Workspace - Add Users adds Google Workspace users retrieved using one of the following modes (or users that have been selected in the asset table):

  • Create a single asset from scratch.
    • The query input is assets of type Accounts.
    • All fields of the newly created Google Workspace user are taken from the enforcement action configuration fields (Username, Email, Password, etc.)
  • Create single/multiple assets from existing assets (Clone operation).
    • The query input is assets of type Users.
    • The fields of the newly created Google Workspace user are taken from the cloned entity, if the data exists. Otherwise, it is taken from the enforcement action configuration fields.
    • Example: Run the Google Workspace - Add Users enforcement action on Users that match the All Okta Users saved query input. This is considered a Clone operation, meaning that each new Okta user acquires the fields of the cloned Okta user, and if there are missing required fields, it checks if there is any matching value in the enforcement action configuration, and if yes, takes the value from there.

See Creating Enforcement Sets to learn more about adding Enforcement Actions to Enforcement Sets.

Note:

General Settings

  • Action name - The name of this Enforcement Action. The system sets a default name. You can change the name.
  • Configure Dynamic Values - Toggle on to enter a Dynamic Value statement. See Creating Enforcement Action Dynamic Value Statements to learn more about Dynamic Value statement syntax.

  • Use stored credentials from Google Workspace (G Suite) adapter - Select this option to use Google Workspace adapter credentials. When you select this option, the Select Adapter Connection dropdown is available, and you can choose which adapter connection to use for this Enforcement Action.
Note:

To use this option, you must successfully configure a Google Workspace adapter connection.

Required Fields

These fields must be configured to run the Enforcement Set.

Additional Fields

These fields are optional.

  • First Name - The user's first name.

  • Last Name - The user's last name.

  • Email - The user's email address.

  • Username - The username by which the user will be known in Google Workspace.

  • First login password generation method - The method used to generate the first login password for the user to gain access.

    • Manual password - When you select this option (the default), enter in Password a password to be used by all new users created by this Enforcement Action until they change it. The password must contain at least eight characters, including one uppercase letter, one lowercase letter, one number, and one special character.
    • Auto-generated password - When you select this option, the system automatically generates a password.
  • Get OAuth Apps - Select this option to fetch the OAuth applications used by each user.

  • Fetch Cloud Identity Devices - Select this option to fetch Cloud Identity devices.
  • Fetch Chrome Browsers - Select this option to fetch Chrome browsers information.
  • Fetch Calendars - Select this option to fetch users' calendars.

  • Email of an admin account to impersonate - The email of your Google Workspace (G Suite) admin.
  • Account Profile Name- Google user name for retrieving SaaS data. https://admin.google.com/ac/accountsettings/profile
  • JSON Key pair for the service account - Upload the JSON file you created for your service account. For more details, refer to Google Workspace adapter.
  • User Name and Password - The credentials for a user account that has the Required Permissions to fetch assets.
  • Login URL - The hostname or IP address of the Google server.
  • 2FA Secret Key - The secret generated in Google Workspace for setting up 2-factor authentication for the Google Workspace user created for collecting SaaS Management data.
  • SSO Provider - If your organization uses Google Workspace for SSO, you can select this check box. For more information, see Connecting your SSO Solution Provider Adapter .
  • Gateway Name - Select the Gateway through which to connect to perform the action.

APIs

Axonius uses the Google Workspace - Manage user accounts API.

Required Permissions

  • This enforcement action requires the following:

    • Permission for creating a user.

    • Entering the scope https://www.googleapis.com/auth/admin.directory.user into your Google account's Domain Wide Delegation for the Client ID used for this connection (inside the JSON file).

  • The Get OAuth Apps option requires addition of the following scope to your Google Workspace (G Suite) admin account: https://www.googleapis.com/auth/admin.directory.user.security

  • The Fetch Cloud Identity Devices option requires the following:

    • Addition of the following scope to your Google Workspace (G Suite) admin account: https://www.googleapis.com/auth/cloud-identity.devices.readonly
    • Enabling the Cloud Identity API.
  • The Fetch Chrome Browsers option requires an additional privilege to your Google Workspace (G Suite) admin account: https://www.googleapis.com/auth/admin.directory.device.chromebrowsers.readonly

  • The Fetch Calendars option requires the following:

    • An additional privilege to your Google Workspace (G Suite) admin account: https://www.googleapis.com/auth/calendar

    • Enabling the Cloud Identity API.

For more information on adding a privilege/scope to your Google Workspace (G Suite) admin account, refer to Configure the OAuth Scopes.
For more information on enabling the Cloud Identity API, refer to Enable Cloud API.



For more details about other Enforcement Actions available, see Action Library.



Was this article helpful?