Status: Active — fully supported
Auth: OAuth 2.0 (refresh token via admin consent)
Syncs: Users, Groups, MFA status, Admin accounts, 2SV enforcement
Auth: OAuth 2.0 (refresh token via admin consent)
Syncs: Users, Groups, MFA status, Admin accounts, 2SV enforcement
What You’ll Need
- Google Workspace Super Admin account
- Google Cloud Console access
- 20 minutes
Step 1 — Create a Google Cloud Project
- Go to console.cloud.google.com
- Click the project dropdown (top left) → New Project
- Name:
SecurAtlas Integration - Click Create
Step 2 — Enable Required APIs
- In your project → APIs & Services → Library
- Search and enable each of these:
- Admin SDK API
- Google Workspace Alert Center API
- Gmail API (for audit logs)
Step 3 — Configure OAuth Consent Screen
- APIs & Services → OAuth consent screen
- User type: Internal (important — restricts to your org only)
- App name:
SecurAtlas - User support email: your admin email
- Developer contact: your admin email
- Click Save and Continue through all steps
Step 4 — Create OAuth Credentials
- APIs & Services → Credentials → Create Credentials → OAuth client ID
- Application type: Web application
- Name:
SecurAtlas - Authorized redirect URIs → Add:
- Click Create
- Copy the Client ID and Client Secret
Step 5 — Configure Admin SDK Scopes
- Go to admin.google.com
- Security → Access and data control → API controls
- Click Manage Domain Wide Delegation
- Click Add new and enter:
- Client ID: (your OAuth Client ID from Step 4)
- OAuth Scopes (paste all at once, comma-separated):
- Click Authorize
Step 6 — Connect in SecurAtlas
- Go to your tenant → Integrations tab
- Click Connect on Google Workspace
- You’ll be redirected to Google’s OAuth consent screen
- Sign in with your Super Admin account
- Click Allow on the permissions screen
- You’re redirected back to SecurAtlas — sync starts immediately
What Gets Synced
| Entity | Data |
|---|---|
| Users | Name, primary email, suspended status, org unit |
| MFA (2SV) | Per-user 2-Step Verification enrollment and enforcement |
| Admin Accounts | Which users have admin or delegated admin roles |
| Groups | All groups and their email addresses |
Findings Generated
| Finding | Trigger |
|---|---|
mfa_not_registered | Users without 2SV enrolled |
gws_admin_no_2sv | Admin accounts without 2SV |
gws_no_2sv_enforced | No org-wide 2SV enforcement policy |
Troubleshooting
'Access denied' during OAuth flow
'Access denied' during OAuth flow
Make sure you’re signing in with a Super Admin account, not a regular admin. Only Super Admins have access to the Admin SDK Directory API.
Sync succeeds but shows 0 users
Sync succeeds but shows 0 users
Check that Domain Wide Delegation was configured correctly in Step 5. The Client ID must match exactly and all scopes must be on one line comma-separated with no spaces.
2SV enforcement shows as 'not enforced' but it is
2SV enforcement shows as 'not enforced' but it is
Google Workspace reports 2SV enforcement per user, not per org. SecurAtlas checks if any user has isEnforcedIn2Sv = true. If enforcement is set at the org level but users haven’t been forced yet, it may show as not enforced until the policy propagates.