KeySkopeAvailable · Reviewed 2026-09-25
Before you start
Have the following access ready before configuring the connection:
- Your organisation’s Google Workspace connection prepared by KeySkope. Its client ID appears in your authenticated workspace.
- A Google Workspace Super Admin to authorise domain-wide delegation.
- A dedicated Workspace administrator account with permission to read the users, groups, memberships and administrator roles being collected.
- Administrator access to your KeySkope workspace.
Read-only permissions
| Setting | Purpose / value |
|---|---|
| admin.directory.user.readonly | Read users. |
| admin.directory.group.readonly | Read groups. |
| admin.directory.group.member.readonly | Read membership. |
| admin.directory.rolemanagement.readonly | Read admin roles and assignments. |
Connect Google Workspace
1. Get your KeySkope client ID
Open your organisation’s KeySkope workspace and go to Setup → Connectors → Google Workspace → Configure.
Copy the numeric KeySkope Google OAuth client ID. KeySkope manages a dedicated service account for your organisation. You do not need a Google Cloud project or a JSON key.
If the connection is not ready, contact KeySkope to prepare it before continuing.
2. Authorise access in Google Workspace
Open Google Admin Console as a Super Admin.
Go to Security → Access and data control → API controls → Manage Domain Wide Delegation and select Add new.
Client ID: enter the KeySkope client ID you copied in step 1.
OAuth scopes: paste this complete comma-separated list:
https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonlySelect Authorise, then open the entry and confirm all four scopes appear. If your organisation requires approval from another Super Admin, complete that approval.
Changes can take up to 24 hours to propagate, although they usually take effect sooner.
3. Enter your administrator email in KeySkope
Open your organisation’s KeySkope workspace and go to Setup → Connectors → Google Workspace → Configure.
Enter your Google Workspace admin email, then select Connect & run first sync. The email must belong to the Google Workspace domain shown in the connection form. No password or JSON key is required.
Connection fields
| KeySkope field | What to enter |
|---|---|
| KeySkope Google OAuth client ID | Provided by KeySkope. Copy this value into Google Admin; it is not a password. |
| Google Workspace admin email | The email of the dedicated Google Workspace administrator whose directory permissions KeySkope will use. Enter a Workspace user’s email, not the service account’s email. |
4. Verify the first sync
Wait for the sync to finish, then check for errors or partial-collection warnings.
In Access explorer, compare these records with Google Admin:
- An active user and a suspended user.
- A group and its direct members.
- An administrator and their assigned admin role.
Confirm the expected records and permissions appear before considering setup complete.
What appears in KeySkope
Directory users, account status, organisational units, manager information, last-login timestamps, direct group memberships and administrator roles.
Gmail messages, Drive files, calendars and document contents are outside this connector’s collection scope. Nested groups are recorded as returned; memberships are not expanded into a complete effective-access graph.
Troubleshooting
| What you see | What to check |
|---|---|
| Not authorised or access denied | Check the numeric client ID, all four authorised scopes, and the permissions of the Workspace administrator entered in KeySkope. Confirm the account belongs to the intended Workspace domain. |
| Users appear, but groups or admin roles are missing | Check the corresponding read-only scope and delegated administrator privileges. Review the sync’s partial-collection details. |
| Invalid credentials | Check that the Workspace administrator account is active, belongs to the displayed domain and has the required directory permissions. If the error persists, contact KeySkope to check the managed service account. |
| Access fails immediately after authorisation | Confirm any required second-admin approval is complete and allow time for Google’s delegation changes to propagate before retrying. |
Manage or remove access
You control the authorised scopes in Google Admin. KeySkope uses its AWS workload identity and Google-managed signing to obtain short-lived access tokens. Neither your organisation nor KeySkope needs to create or exchange a service-account JSON key for this managed connection. The authorised account can read the directory using the four scopes above and the permissions of the selected Workspace administrator.
To stop collection, reset the Google Workspace connector in KeySkope. To remove Google authorisation, also remove the KeySkope client ID from Domain-wide delegation in Google Admin. Previously issued access tokens may remain valid until they expire. Previously collected access history remains in KeySkope.
If you already connected using your own JSON key, keep that connection until KeySkope prepares the managed identity. Authorise the new client ID, edit the connection to enter your admin email, and verify a successful sync before removing the old delegation and key.
Official references
Vendor documentation reviewed on 2026-09-25 and checked against the current KeySkope connector. Google’s available controls can vary with administrator permissions and organisation policies.
Ready to connect?
Open Connectors in your KeySkope workspace to get your client ID and enter your Workspace admin email. Never send service-account keys or passwords to KeySkope support.
Use your organisation’s dedicated KeySkope URL from an allowed network. Your workspace administrator can provide the address.