Google Workspace

Professional Enterprise

runZero integrates with Google Workspace to allow you to sync and enrich your asset inventory, as well as gain visibility into users and groups. Adding your Google Workspace data to runZero makes it easier to find unmanaged assets on your network.

The following Google Workspace registered asset types are supported:

  • ChromeOS devices
  • Mobile devices
  • Endpoint devices

How runZero maps Google Workspace devices to assets:

  • For devices that can be matched to an existing runZero asset, asset-level attributes such as operating system, hardware platform, hostname, and MAC address will be updated, and Google Workspace-specific attributes will be added.
  • For hosts that cannot be matched with an existing runZero asset, a new asset will be created in the site specified when the integration task is set up.

runZero is able to merge existing assets with ChromeOS devices when the IP address, hostname, or MAC address overlaps. Mobile devices will be merged with existing runZero assets when the MAC address matches. Endpoint devices will be merged with existing runZero assets when the hostname or MAC address match. Google Workspace devices can also be manually merged into runZero assets using the Merge button on the Asset Inventory page.

Requirements

  • Verify you have runZero Professional or runZero Enterprise.
  • Verify you have a Google Workspace service account with the following OAuth scopes added in a comma-delimited list:
    • https://www.googleapis.com/auth/admin.directory.user.readonly
    • https://www.googleapis.com/auth/admin.directory.group.readonly
    • https://www.googleapis.com/auth/admin.directory.device.mobile.readonly
    • https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly
    • https://www.googleapis.com/auth/cloud-identity.devices.readonly
  • Download a key for the Google service account.
  • Verify you have these Google APIs enabled:

How to set up the Google Workspace integration

These are the high-level steps to set up the Google Cloud Platform integration:

Step 1: Create a Google Workspace credential

  1. Go to the Credentials page and click Add Credential.
  2. From the Credentials type dropdown, choose Google Workspace Client Secret.
  3. Provide a name for the credential, like Google Workspace.
  4. In the Admin account email field, provide the email address of an adminstrator account with access to the assets, users, or groups you wish to import.
  5. If you want to import from an organization other than the one your administrator account belongs to, provide a Customer ID. By default, runZero will use the Customer ID associated with the service account. (Optional)
  6. Click Choose file to upload the service account key file you downloaded from Google Workspace.
  7. If you want other organizations to be able to use this credential, select the Make this a global credential option. Otherwise, you can configure access on a per-organization basis.
  8. Save the credential. You’re now ready to set up and activate the connection to bring in data from Google Workspace.

Step 2: Activate the Google Workspace connection

After you have added your Google Workspace credential, there are two ways to set up the data import:

  • Enabling the Workspace probe as part of a runZero scan, or
  • Setting up a scheduled import task.

The first option is useful if you are running self-hosted runZero Enterprise and your console cannot access Google Workspace. For most situations it will be easier to set up a scheduled connection to sync your data from Google Workspace.

A connection requires you to set a schedule and choose a site. The schedule determines when the sync occurs, and the site determines where the data is organized.

  1. Activate a connection to Google Workspace. You can access all available connections from your inventory or Tasks page.
  2. Choose the credential you added earlier. If you don’t see the credential listed, make sure the credential has access to the organization you are currently in.
  3. Enter a name for the task, like Google Workspace sync.
  4. Schedule the sync. A sync can be set to run on a recurring schedule or run once. The schedule will start on the date and time you have set.
  5. To organize your assets logically, choose the site you’d like to use to add your assets to. You can choose an existing site or add them to a new site when the sync occurs. Assigning your assets to a site helps organize and group your assets.
  6. Activate the connection when you are done. The sync will run on the defined schedule. You can check the Scheduled tasks to see when the next sync will occur.

Step 3: View your Google Workspace assets

After a successful sync, you can go to your inventory to view your Google Workspace assets. These assets will have a Google Workspace icon listed in the Source column.

To view all your Google Workspace assets, run the following query:

source:googleworkspace

Click into each asset to see its individual attributes. runZero will show you the attributes returned by Google Workspace.

Step 4: View Google Workspace assets

After a successful sync, you can go to your inventory to view your Google Workspace assets. These assets will have a Google Workspace icon listed in the Source column.

To filter by Google Workspace assets, consider running the following queries:

Click into each asset to see its individual attributes. runZero will show you the attributes returned by Google Workspace.

Enterprise

For Enterprise users, the Google Workspace integration provides details about users and groups in addition to enriching asset inventory data. Go to Inventory > Users or Inventory > Groups to view the data provided by Google Workspace. Use the query source:googleworkspace to filter your results.