> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-baton-kubernetes.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# 📜 Google Workspace integration

> C1 provides identity governance and just-in-time provisioning for Google Workspace. Integrate your Google Workspace instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

<Tip>
  **A newer version of this connector is available.** If you're setting up a Google Workspace connector with C1 for the first time, use the [v2 version](/baton/google-workspace).
</Tip>

## Availability

<Icon icon="square-check" iconType="solid" color="#c937ae" /> **General availability.** The Google Workspace connector is available to all C1 users.

## Capabilities

* Sync user identities from Google Workspace to C1

* Resources supported:
  * Groups
  * Roles

* Provisioning supported:
  * Group membership
  * Role assignment

## Set up the Google Workspace integration

<Warning>
  This task requires either the **Connector Administrator** or **Super Administrator** role in C1.
</Warning>

<Steps>
  <Step>
    In C1, navigate to **Integrations** > **Connectors** > **Google Workspace**.
  </Step>

  <Step>
    If this is your first Google Workspace integration, the integration form opens automatically. Otherwise, click **Add connector**.
  </Step>

  <Step>
    Choose whether to add the new Google Workspace connector as a data source to an existing application (and select the app of your choice) or to create a new application.
  </Step>

  <Step>
    Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

    <Warning>
      A Google Workspace connector owner must have the following permissions:

      * **Connector Administrator** or **Super Administrator** role in C1
      * **Super Admin** role in Google Workspace
    </Warning>
  </Step>

  <Step>
    Click **Next**.
  </Step>
</Steps>

### Next steps

* **If you are the integration owner**, proceed to [Integrate your Google Workspace instance](/baton/v1/google-workspace#integrate-your-google-workspace-instance) for instructions on integrating Google Workspace with C1.

* **If someone else is the integration owner**, C1 will notify them by email that their help is needed to complete the setup process.

## Integrate your Google Workspace instance

<Warning>
  A user with the **Connector Administrator** or **Super Administrator** role in C1 and **Super Admin** role in Google Workspace must perform this task.
</Warning>

### Step 1: Sign in to the Google Cloud Console and Create a New Project

<Steps>
  <Step>
    As a Google Workspace Super Admin, sign in to [https://console.cloud.google.com](https://console.cloud.google.com/).
  </Step>

  <Step>
    In the toolbar, click the project select dropdown, and click **NEW PROJECT**.
  </Step>

  <Step>
    Create a new project for your organization:

    * **Project Name**: Choose a names, cush as "C1 Integration"
    * **Organization/Location**: Choose the appropriate Organization/Location
  </Step>

  <Step>
    After the project is created, make sure the correct project is selected in the dropdown at the top.
  </Step>
</Steps>

### Step 2: Enable the API

<Steps>
  <Step>
    In the navigation menu, navigate to > **APIs & Services** > **Library**.
  </Step>

  <Step>
    Search for and select the Admin SDK API.
  </Step>

  <Step>
    Click **Enable**.
  </Step>
</Steps>

### Step 3: Create a service account

<Steps>
  <Step>
    In the navigation menu, navigate to > **APIs & Services** > **Credentials**.
  </Step>

  <Step>
    Select **CREATE CREDENTIALS** > **Service Account**.
  </Step>

  <Step>
    Under **Service account details**, fill in the following:

    * **Service account name:** C1 Integration
    * **Service account description:** for example, "Service account for C1 Google Workspace Integration"
    * Click **CREATE AND CONTINUE**
  </Step>

  <Step>
    Under **Grant this service account access to a project**, grant the **Editor** role.
  </Step>

  <Step>
    Leave **Grant users access to this service account** blank.
  </Step>

  <Step>
    Click **DONE**.
  </Step>
</Steps>

### Step 4: Get credentials

<Steps>
  <Step>
    Navigate back to **APIs & Services** > **Credentials** and select the service account you just created.

    <br />
  </Step>

  <Step>
    Click the service account's email address. Locate and save the **Unique ID**. We'll use this in Step 5.
  </Step>

  <Step>
    On the **Service Account Details Page**, click **KEYS**.
  </Step>

  <Step>
    Click **ADD KEY** > **Create new key**.
  </Step>

  <Step>
    Choose **JSON** and click **CREATE**.

    <br />
  </Step>

  <Step>
    Keep the downloaded file safe. We'll use it in Step 7.
  </Step>
</Steps>

### Step 5: Add Service Account to Google Workspace

<Steps>
  <Step>
    Go to [https://admin.google.com](https://admin.google.com) as a **SUPER ADMIN**.
  </Step>

  <Step>
    In the navigation menu, select **Security** > **Access and data control** > **API Controls**.
  </Step>

  <Step>
    Click **MANAGE DOMAIN WIDE DELEGATION**.
  </Step>

  <Step>
    Click **Add new** and fill out the form:

    * **Client ID**: The saved ID from Step 4
    * **OAuth Scopes**: Copy and paste one of the following lists of required scopes for your use case:

      * Use the following read-only scopes if you are **not** using the Google Workspace integration for provisioning:

        ```bash theme={null}
        https://www.googleapis.com/auth/admin.directory.user.alias.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly
        ```

      * Use the following scopes if you are using the Google Workspace integration for provisioning Groups and Roles:

        ```bash theme={null}
        https://www.googleapis.com/auth/admin.directory.user.alias.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement,https://www.googleapis.com/auth/admin.directory.group.member,https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly
        ```
  </Step>

  <Step>
    Click **AUTHORIZE**.
  </Step>

  <Step>
    In the navigation menu, select **Account > Account Settings**.
  </Step>

  <Step>
    Copy the **Customer ID** from this page. We'll use it in Step 7.
  </Step>
</Steps>

### Step 6: Locate your Primary Domain

<Steps>
  <Step>
    In the navigation panel on the left, click **Account** > **Domains**.
  </Step>

  <Step>
    Click **Manage Domains**. Locate and copy the domain labeled as the **Primary Domain** in the **Type** column. We'll use this in Step 7.
  </Step>
</Steps>

### Step 7: Add your Google Workspace credentials to C1

<Steps>
  <Step>
    In C1, navigate to **Integrations** > **Connectors** > **Google Workspace**.
  </Step>

  <Step>
    In the list of connectors, locate and click on the name of the connector with the **Not connected** label.
  </Step>

  <Step>
    Find the **Settings** area of the page and click **Edit**.
  </Step>

  <Step>
    In the **Customer ID** field, enter the customer ID from Step 5.
  </Step>

  <Step>
    In the **Domain** field, enter the primary domain from Step 6.
  </Step>

  <Step>
    In the **Administrator email** field, enter the email address associated with your domain or a super admin.
  </Step>

  <Step>
    In the **Credentials (JSON)** area, click **Choose file** and upload the file from Step 4.
  </Step>

  <Step>
    Click **Save**.
  </Step>

  <Step>
    The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
  </Step>
</Steps>

**Done.** Your Google Workspace connector is now pulling access data into C1.

### What's next?

If Google Workspace is your company's identity provider (meaning that it is used to SSO into other software), the integration sync will automatically create applications in C1 for all of your SCIMed software. Before you move on, review the [Create applications](/product/admin/applications) page for important information about how to set up integrations with the SCIMed apps.