Sync Google Workspace

The Google Workspace sync in Portail ZAPP reads your Google Workspace domain directory and fills in each account's line manager, just as the Microsoft 365 and Active Directory syncs do. It works one way only: from Google Workspace to Portail ZAPP. It never changes Google Workspace.

The screen is for administrators. Open it from Administration › Connectors and automation › Google Workspace sync (/google-directory-sync).

Prepare Google Workspace

The sync uses the Admin SDK Directory API, through a service account allowed to act on behalf of a domain administrator:

1. In the Google Cloud console, create a service account and download its JSON key. Enable the Admin SDK API on the project.
2. In the Google Workspace admin console (Security › Access and data control › API controls › Domain-wide delegation), add the service account's client ID with the scope https://www.googleapis.com/auth/admin.directory.user.readonly. This scope can only read users.
3. Pick a domain administrator who can read users: the Google API requires acting on their behalf.
4. In Portail ZAPP, store the full JSON key in a vault secret.

Configure the sync

• Service account key (vault): the secret that holds the JSON key. Portail ZAPP never shows the key, only the secret's name.
• Impersonated administrator: the address of the chosen administrator.
• Google Workspace customer: keep my_customer for the administrator's own domain; otherwise enter the customer ID (it starts with C0).
• Fill in each account's line manager: off by default. While it is off, the sync reads nothing.

Test the connection tries the saved settings: it gets a token on behalf of the administrator, then reads one account. If it fails, the message says what to check: unreadable key, missing domain-wide delegation or scope, administrator without read access, Google unreachable.

What a sync does

1. Every user of the Google customer is read, page by page. If reading fails part-way, nothing is changed.
2. Each Google user is matched with a Portail ZAPP account by their primary address: sign-in name first, then email address if only one account has it. An address held by several accounts is skipped (Ambiguous addresses counter).
3. The manager set in Google (the user's Manager relation) is found through any of their addresses, primary or alias.

The rules are the same as for Microsoft 365 and Active Directory:

• a locked link (entered by hand, by default) is never changed;
• a manager Portail ZAPP does not know changes nothing;
• a user with no manager in Google has their link ended only if that link came from a sync;
• a new manager ends the current link and opens a new one: the history stays on the account's Managers and history page, with the source "Google Workspace".

The sync never creates, changes or disables an account: it only deals with managers.

Run and schedule

Sync now runs a pass straight away. The "GoogleDirectorySync" job in the Scheduler also runs every night at 2:45 AM; it does nothing while manager filling is off.

The Last run panel shows the date and the summary: Google accounts read and matched, managers updated, unchanged, locked links left as they were, unknown managers, loops avoided and ambiguous addresses. If the run failed, it shows the reason.